Disclosed weakness · no CVE recorded

Prefab generated-code output can mix up responses on a shared UI server

PrefectHQ · prefab-ui PyodideSandbox / FastMCP GenerativeUI

First documented disclosure · Review checkpoint

Summary

Printing from generated code can shift the response stream and return the previous request’s UI.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Public bug report with a controlled reproduction; malicious exploitation and confirmed third-party exposure are not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The persistent sandbox uses stdout for JSON-lines replies but generated Python output reaches the same stream. A failed decode leaves replies queued one request behind.

Conditions required

A long-lived PyodideSandbox executes code that prints. Cross-user exposure requires different users to share that sandbox process.

Potential impact

Wrong or stale UI responses; a shared server can expose a prior user’s generated UI to a subsequent caller. The report’s controlled reproduction demonstrates response mixing, not a confirmed malicious data theft.

Affected versions and configurations

Confirmed in prefab-ui 0.20.2. The earliest affected release is not established.

Fix and mitigation status

0.21.0 includes output suppression, request correlation and rejection/restart for malformed or stale responses.

Practical next steps

Upgrade to 0.21.0 or a later supported release. Until updated, avoid sharing a long-lived sandbox across users; a restart clears the observed shift but does not fix its cause.

Operating lesson

Separate generated program output from the control protocol, and verify every response belongs to its request.

Evidence and limits

Public issue October 6; fix merged October 25 and released October 26. This response-channel flaw is distinct from CVE-2026-120338’s retained Deno permissions, although one patch addresses both. No exact CVE mapping was established. The patched warm Python interpreter still shares state across calls, so this fix is not a general cross-user isolation guarantee.

Sources