Prefab UI is vulnerable to Remote Code Execution via a Pyodide js Bridge to Deno

Summary

CVE-2026-120338 (CVSS 10, critical) affects prefab-ui from 0.14.0 before 0.21.0. Its Generative UI sandbox runs caller-supplied Python in a Deno subprocess started with unrestricted --allow-read, --allow-write and --allow-net, and the Deno API remains reachable from Python through Pyodide's js module, letting callers read and write host files. The usual remote path is the generate_prefab_ui tool in FastMCP's GenerativeUI provider, which is exposed unauthenticated on servers with no authentication configured, and the flaw is reachable there.

Mitigation

Upgrade prefab-ui to 0.21.0 or later. The runner then revokes Deno filesystem read, filesystem write and network permission after startup and before it accepts generated code.

Related items

• MediumGHSA-j656-3hf2-fvjc: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationSimilar attack · GitHub Advisory Database
• MediumCritical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersSimilar attack · The Hacker News
• LowChainalysis Discloses Data Breach Following AI-Driven CyberattackSimilar attack · SecurityWeek
• CriticalBeta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah IsolationSimilar attack · JFrog Security Research (Vulnerabilities)
• CriticalBeta9 is vulnerable to a Container Escape via Unvalidated Sandbox File PathsSimilar attack · JFrog Security Research (Vulnerabilities)