# CVE-2026-120338: Prefab UI sandbox escape via unrestricted Deno permissions

Source: https://junglewise.ai/threats/cve-2026-120338-prefab-ui-s-generative-ui-sandbox-runs-caller-supplied-python  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120338 · Severity: critical · CVSS 10 · Published 2026-11-01

Prefab UI is a Python framework for building web interfaces, and includes a sandboxed environment to safely run Python code generated by AI systems. However, versions 0.14.0 through 0.20.2 fail to properly isolate this sandbox, allowing an attacker who supplies code (or who can reach a FastMCP server without authentication) to read and write arbitrary files on the server as the application user, potentially achieving persistent code execution.

## Quick answers

**Is CVE-2026-120338 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120338 being exploited in the wild.

**How severe is CVE-2026-120338?** Critical severity, with a CVSS score of 10, published 1 November 2026.

**Which products and versions are affected?** Prefect Prefab-Ui 0.14.0 through 0.20.2.

**Is there a fix for CVE-2026-120338?** Yes: fixed in 0.21.0. Until then: Disable the Generative UI feature if not in use. If enabled, ensure FastMCP authentication is properly configured so only trusted clients can invoke the generate_prefab_ui tool. Ensure Deno is not installed on the server if this feature is not needed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120338 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120338?** Check whether you run Prefect Prefab-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.21.0

Disable the Generative UI feature if not in use. If enabled, ensure FastMCP authentication is properly configured so only trusted clients can invoke the generate_prefab_ui tool. Ensure Deno is not installed on the server if this feature is not needed.

## Technical details

The Generative UI sandbox runs user-supplied Python via Pyodide inside a Deno subprocess, but launches Deno with unrestricted --allow-read, --allow-write, and --allow-net permissions and leaves the Deno API accessible on the JavaScript global object. Pyodide's js module proxies this global, enabling the Python code to call Deno.readTextFileSync() and Deno.writeTextFileSync() to directly access the filesystem. An attacker can persist code execution by writing a .pth file into the server's site-packages directory. The attack requires either direct code supply or network access to a FastMCP server running the GenerativeUI tool without authentication enabled.

## Affected products

- Prefect prefab-ui 0.14.0 through 0.20.2

## Timeline

- 2026-11-01: disclosed

## References

- [https://pypi.org/project/prefab-ui/](https://pypi.org/project/prefab-ui/)
- [https://github.com/PrefectHQ/prefab](https://github.com/PrefectHQ/prefab)