CVE-2026-120338: Prefab UI's Generative UI sandbox for untrusted code, including code written by a large language model, let that code read and write files on the server
The National Vulnerability Database (NVD) record says that from prefab-ui 0.14.0 through 0.20.2 the Generative UI sandbox, documented as isolation for untrusted code including code written by a large language model (LLM), started Deno with unrestricted read, write and network permission, so supplied code could read and write files as the server's operating system user; the usual remote path is FastMCP's Model Context Protocol (MCP) tool generate_prefab_ui; fixed in 0.21.0.
The record
- Kind
- Vulnerability
- Source record
- CVE-2026-120338: Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, (National Vulnerability Database record)
- Record published
- 2026-11-01
- Posted here
- 2026-11-02
- World
- Software agents · Enterprise work agents
- Controls concerned
- Containment and isolation C-E5; Authority binding C-A2
- Checked
- Checked against its record on 2026-11-02 by a reader who did not draft it; report
verification/reports/SIG-2026-11-02-001-2026-11-02.md.
A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.
What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.
New signals like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly emailNewer: GHSA-j656-3hf2-fvjc: DBHub read-only mode bypass on MySQL and MariaDB
Older: CVE-2026-61789: DBHub, a database Model Context Protocol (MCP) server, lets SQL that hides a write behind a double dash pass its read-only check on MySQL and MariaDB