Prefab UI Generative UI sandbox escape
Prefab UI 0.14.0 through 0.20.2 can expose host files through its optional Generative UI sandbox. Version 0.21.0 fixes the flaw.
- Vendor
- PrefectHQ
- Product
- prefab-ui
- CVSS
- 10.0
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-120338 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-120338 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-01 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-01. Full cross-catalog view: /kev-comparison
CVE-2026-120338 timeline
- Patch available-6d (before NVD)prefab-ui 0.21.0 released with the sandbox fix
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The published CVE record identifies a sandbox escape in Prefab UI’s optional Generative UI feature. It affects prefab-ui versions 0.14.0 through 0.20.2. The feature runs supplied Python in Pyodide inside a Deno subprocess, but the affected sandbox leaves host file access available to that code. A caller allowed to supply code can therefore read or write files with the server process’s permissions. The record describes a path to persistent host code execution.
JFrog, the CVE numbering authority for this record, assigns CVSS 3.1 10.0 (Critical) to the scenario where an unauthenticated FastMCP server exposes Generative UI and has Deno installed. Its separate score for a client already authenticated and allowed to call tools is 9.9. Neither score means every Prefab UI installation is remotely reachable: Generative UI is opt-in, and the relevant server and access conditions must be present.
Fix: Upgrade prefab-ui to 0.21.0 or later. The 0.21.0 release includes the sandbox changes referenced by the CVE record. Inventory deployments that enable Generative UI, check the installed package version, and review who can reach or invoke the associated FastMCP tool. The NVD record and CVE Program record provide the vulnerability details; the linked GitHub security advisory was not publicly accessible at publication.
