Prefab UI: Sandbox escape to host code execution in Generative UI
Summary
Prefab UI, a Python framework for generative user interfaces, runs caller-supplied Python in a Pyodide sandbox inside a Deno subprocess. The sandbox exposes the Deno API to the Python code, so an attacker who can supply code can read and write files as the server OS user and persist code execution by writing a .pth file into the server virtualenv. The feature is reached through FastMCP's GenerativeUI provider: on servers without authentication, any client that can reach the server can call the tool, and with authentication, any client allowed to call tools can. Generative UI is opt-in and requires Deno on the host.
Affected
- prefab-ui 0.14.0 through 0.20.2 (CVE record: 0.14.0 to before 0.21.0)
- Only deployments with Generative UI enabled (FastMCP GenerativeUI provider) and Deno installed on the host are exploitable
Fixed in
- prefab-ui 0.21.0 according to the CVE record (commit 030f074, pull request 538)
- Confirm the fix in the GitHub advisory; upgrade to 0.21.1 or later
Workaround
- Unknown. No vendor workaround is documented in the sources reviewed.
- Disable the GenerativeUI provider and the generate_prefab_ui tool if they are not needed.
- Remove Deno from hosts where the sandbox is not needed.
Exploitation
- No known exploitation in the wild at the time of writing.
- No public proof of concept found at the time of writing.
Our recommendation
- Upgrade prefab-ui to 0.21.1 or later in all virtualenvs, containers and images.
- Check whether the Generative UI provider is enabled and whether Deno is installed on the host.
- Restrict access to MCP servers and require authentication.
- Check the server virtualenv site-packages for unexpected .pth files and review recent file changes made by the server user.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-595q-jv4r-q7j9 github.com
- Fix commit 030f074 github.com
- Pull request 538 github.com
- Prefab v0.21.0 release github.com
- Prefab v0.20.2 release github.com
- prefab-ui on PyPI pypi.org
- VulDB entry 429663 vuldb.com
- FastMCP Generative UI documentation gofastmcp.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:20.
Original description (NVD)
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).
NVD references (9)
- https://github.com/PrefectHQ/prefab
- https://github.com/PrefectHQ/prefab/commit/030f074f85e0b1be0dd44b0283185aecb26337a2
- https://github.com/PrefectHQ/prefab/pull/538
- https://github.com/PrefectHQ/prefab/releases/tag/v0.14.0
- https://github.com/PrefectHQ/prefab/releases/tag/v0.20.2
- https://github.com/PrefectHQ/prefab/releases/tag/v0.21.0
- https://github.com/PrefectHQ/prefab/security/advisories/GHSA-595q-jv4r-q7j9
- https://pypi.org/project/prefab-ui/
- https://pypi.org/project/prefab-ui/0.21.0/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.