{"data":{"id":"899fa0ff-3bae-4b77-a2e3-c02c2a170b8a","title":"Prefab UI is vulnerable to Remote Code Execution via a Pyodide js Bridge to Deno","summary":"CVE-2026-120338 (CVSS 10, critical) affects prefab-ui from 0.14.0 before 0.21.0. Its Generative UI sandbox runs caller-supplied Python in a Deno subprocess started with unrestricted --allow-read, --allow-write and --allow-net, and the Deno API remains reachable from Python through Pyodide's js module, letting callers read and write host files. The usual remote path is the generate_prefab_ui tool in FastMCP's GenerativeUI provider, which is exposed unauthenticated on servers with no authentication configured, and the flaw is reachable there.","solution":"Upgrade prefab-ui to 0.21.0 or later. The runner then revokes Deno filesystem read, filesystem write and network permission after startup and before it accepts generated code.","labels":["security"],"sourceUrl":"https://research.jfrog.com/vulnerabilities/prefab-ui-is-vulnerable-to-remote-code-execution-via-a-pyodide-js-bridge-to-deno-cve-2026-120338-jfsa-2026-001699278/","publishedAt":"2026-11-01T00:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Prefab UI","FastMCP","Pyodide","Deno"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-01T00:00:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}