{"id":"CVE-2026-120338","kind":"vulnerability","aliases":["CVE-2026-120338"],"related":[],"title":"Prefab UI: Generative UI sandbox lets Python read and write server files","description":"Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).","summary":"Prefab UI's Generative UI sandbox exposes the Deno API to caller-supplied Python code, so the code can read and write files as the server OS user. An attacker can also persist code execution by writing a .pth file into the server virtualenv's site-packages.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fastmcp","mcp","package","prefab-ui","python","self-hosted"],"not_affected_if":["generative-ui-disabled","no-deno-installed","version-0.21.0-or-later"],"how_to_check":"- Check the installed version of `prefab-ui` in the server virtualenv, for example with `pip show prefab-ui`.\n- Check whether FastMCP's GenerativeUI provider is enabled and whether the `generate_prefab_ui` tool is registered.\n- Check whether `deno` is installed on the host.\n- Check whether the FastMCP server has authentication configured.","fix":"- `prefab-ui` `0.21.0` (fixed; affected range 0.14.0 through 0.20.2)","status":"open","published_at":"2026-11-01T16:18:14+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","triaged_at":"2026-11-01T16:22:42+00:00","updated_at":"2026-11-01T16:22:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T16:22:42Z","model":"claude-haiku-5-5","output":{"fix":"- `prefab-ui` `0.21.0` (fixed; affected range 0.14.0 through 0.20.2)","reach":"network","title":"Prefab UI: Generative UI sandbox lets Python read and write server files","impact":"high","summary":"Prefab UI's Generative UI sandbox exposes the Deno API to caller-supplied Python code, so the code can read and write files as the server OS user. An attacker can also persist code execution by writing a .pth file into the server virtualenv's site-packages.","audience":"developers","category":"package","nicknames":[],"who_cares":["prefab-ui","fastmcp","mcp","python","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads and writes server files and persists code execution","analyst_note":"Confirm the NVD entry and the fix commit 030f074 (pull request 538) against the vendor's advisory; the sources do not state the exact authentication requirement for the remote path beyond the description.","how_to_check":"- Check the installed version of `prefab-ui` in the server virtualenv, for example with `pip show prefab-ui`.\n- Check whether FastMCP's GenerativeUI provider is enabled and whether the `generate_prefab_ui` tool is registered.\n- Check whether `deno` is installed on the host.\n- Check whether the FastMCP server has authentication configured.","plain_action":"","needs_analyst":true,"not_affected_if":["generative-ui-disabled","no-deno-installed","version-0.21.0-or-later"],"who_is_affected":"Teams running prefab-ui from 0.14.0 through 0.20.2 with Generative UI enabled and Deno installed on the host. The FastMCP GenerativeUI path is the usual remote route, and a server with no authentication lets any reachable client call the tool; with authentication, any client allowed to call tools can. Systems that do not enable Generative UI, or that lack Deno, are not affected by this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000816,"input_tokens":4557,"output_tokens":721,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120338':15A,18A '-2026':14A,17A '0.14.0':117C '0.20.2':119C,271C '0.21.0':274C '030f074':323C '538':326C 'accept':293C 'access':314C 'allow':127C,130C,134C,248C 'allow-net':133C 'allow-read':126C 'allow-writ':129C 'also':61B 'api':38B,142C 'argument':221C 'attack':59B 'authent':231C,245C 'bootstrap':312C 'call':159C,241C,250C 'caller':41B,86C,164C 'caller-suppli':40B,85C 'cannot':307C 'cdn.jsdelivr.net':318C 'client':234C,247C 'code':44B,47B,63B,107C,169C,183C,220C,294C 'commit':322C 'compil':92C 'configur':232C 'confirm':266C 'cve':13A,16A 'deno':37B,97C,123C,141C,264C,285C 'deno.readtextfilesync':160C 'deno.writetextfilesync':162C 'document':102C 'execut':64B,184C 'expos':35B 'fastmcp':19B,203C,227C 'featur':100C 'file':12A,52B,69B,174C,189C 'fix':272C,320C 'forward':216C 'generat':3A,32B,81C,212C,253C 'generativeui':205C 'global':146C,154C 'grant':308C 'host':28B,261C 'includ':108C 'insid':89C 'instal':265C 'isol':104C 'javascript':145C 'js':150C 'launcher':121C 'leav':139C 'let':6A 'limit':316C 'llm':110C 'llm-written':109C 'load':281C 'mcp':20B,210C 'modul':151C 'must':262C 'net':135C 'network':289C,313C 'no-prompt':300C 'object':147C 'opt':257C 'opt-in':256C 'os':56B,178C 'packag':21B,77B,197C 'path':201C 'permiss':290C,305C 'persist':62B,182C 'prefab':1A,23B,29B,78C,115C,213C,269C,279C 'prefab-ui':22B,114C,268C 'process':296C 'prompt':302C 'provid':206C 'proxi':152C 'pth':68B,188C 'pull':324C 'pyodid':90C,148C 'python':7A,25B,43B,88C,91C,157C 'reach':237C 'read':8A,49B,128C,171C,286C 'regist':208C 'remot':200C 'request':306C,325C 'revok':284C 'run':84C 'runner':138C,283C 'runtim':277C 'sandbox':5A,34B,83C,224C 'self':27B 'self-host':26B 'server':11A,55B,72B,177C,192C,228C,239C 'site':76B,196C 'site-packag':75B,195C 'sourc':280C 'start':122C,298C 'subprocess':98C 'suppli':42B,87C,167C 'tool':211C,218C,243C,251C 'ui':2A,4A,24B,30B,33B,79C,82C,112C,116C,214C,254C,270C 'unrestrict':125C 'untrust':106C 'user':57B,179C 'usual':199C 'virtualenv':73B,193C 'webassembl':94C 'write':10A,51B,66B,131C,173C,186C,287C 'written':111C","nicknames":[],"mitigations":[],"who_affected":"Teams running prefab-ui from 0.14.0 through 0.20.2 with Generative UI enabled and Deno installed on the host. The FastMCP GenerativeUI path is the usual remote route, and a server with no authentication lets any reachable client call the tool; with authentication, any client allowed to call tools can. Systems that do not enable Generative UI, or that lack Deno, are not affected by this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"reefs@jfrog.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120338","severity":null,"published_at":"2026-11-01T16:18:14+00:00","modified_at":"2026-11-01T16:18:14+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","fetched_at":"2026-11-01T16:20:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}