CVE-2026-120338: Prefab UI Sandbox Escape

CVE-2026-120338 is a sandbox escape in Prefab UI versions 0.14.0 through 0.20.2. Prefab UI executes user-supplied Python code inside Pyodide (Python compiled to WebAssembly) in a Deno subprocess, designed to isolate untrusted code including code written by LLMs. The vulnerability allows code suppliers to read and write server files as the OS user, and to maintain access by writing .pth files into the server virtualenv.

The CVSS score is 10.0 (critical). Attack vector depends on who can supply code via FastMCP GenerativeUI. On an unauthenticated FastMCP server, any client can trigger the vulnerability; with authentication, any authorized tool caller can. The fix is version 0.21.0 (commit 030f074), which revokes Deno permissions before accepting code.

Immediate actions: upgrade Prefab UI to 0.21.0 or later; verify if your deployment includes FastMCP with GenerativeUI enabled and Deno installed (both required for risk); if in use, restrict FastMCP server access to trusted clients; reconfigure MCP permissions to limit available tools. There is no confirmed public exploit in the available data, but social signals show initial awareness (8 posts in the preceding 24 hours).