Prefab UI 0.21 Fixes CVSS 10.0 Sandbox File Read/Write Vulnerability

On November 1, JFrog Security Research published vulnerability report CVE-2026-120338 targeting Prefab UI, the generative UI framework from PrefectHQ. The GitHub advisory rates the vulnerability at a maximum CVSS score of 10.0. Across versions 0.14.0 through 0.20.2, callers able to submit code to the Generative UI sandbox could read and write files on the host machine.

A fix was already shipped prior to public disclosure. Prefab-ui 0.21.0 was released on October 26—six days before the CVE went public—followed by version 0.21.1 on the same day. If you run FastMCP with Generative UI enabled, verifying this component should be at the top of your checklist.

Prefab's Generative UI executes caller-supplied Python code inside Pyodide, which runs within a Deno subprocess. On paper, this provides two layers of isolation. However, JFrog highlighted two configuration choices that neutralized both barriers:

• The launcher started Deno with unrestricted --allow-read, --allow-write, and --allow-net permissions.
• The runner left the Deno API exposed on the JavaScript global object, allowing Python code to invoke js.Deno.readTextFileSync and js.Deno.writeTextFileSync directly on the host.

Stock photo for illustration only, not from the actual event

While reading files is damaging, writing them is significantly worse. In version 0.20.2, JFrog leveraged the write capability to plant a .pth file inside the server virtualenv's site-packages directory. Consequently, any subsequent Python process utilizing that environment executed the planted import automatically outside any sandbox boundaries, exploiting a long-standing Python feature where .pth files starting with import lines are executed via exec() during interpreter startup.