CVE-2026-120338

Prefab generative UI inherits Deno host permissions

PrefectHQ · prefab-ui generative UI / FastMCP tool

First documented disclosure · Review checkpoint

Summary

Generated Python can cross the rendering sandbox into host resources.

Severity and exploitation evidence

Critical · 10.0/10 · CVSS 3.1. Severity source.

Exploitation not established: CNA technical disclosure; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Pyodide reaches JavaScript Deno APIs while the process retains filesystem and network permissions.

Conditions required

Opt-in generative UI, Deno installed and access to generate_prefab_ui; authentication depends on the FastMCP deployment.

Potential impact

Application-user file access; writable Python startup locations can support later persistent execution.

Affected versions and configurations

>=0.14.0 and <0.21.0, including 0.20.2.

Fix and mitigation status

0.21.0.

Practical next steps

Upgrade; the patch revokes read/write/network permissions before generated code, prevents prompts and restricts bootstrap downloads.

Operating lesson

Bootstrap permissions must be removed before any untrusted code runs.

Evidence and limits

Public security-relevant PR October 25, release October 26, CNA November 1. JFrog scores the unauthenticated scenario 10.0 and authenticated scenario 9.9. Linked GHSA was unavailable; CNA, patch PR and release were verified.

Sources