CVE-2026-120338: 0.21 Remote Code Execution (RCE) - Analysis & Fix

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).

Official Advisories & References

CVE-2026-120338 AI (Artificial Intelligence) Analysis

CVE-2026-120338: Prefab UI Generative Sandbox RCE via Deno Permission Bypass

Community & Discussion

Critical Vulnerabilities — Last 7 Days

Real-time tracking of CVSS 9.0+ remote execution zero-days, public exploit code, and ransomware-linked vulnerabilities disclosed this week.

Frequently Asked Questions

CVE-2026-120338 is a Critical severity security vulnerability. Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for...

This vulnerability has a CVSS score of 10 out of 10, rated as Critical. Critical vulnerabilities can be exploited remotely without authentication and may lead to full system compromise, data theft, or malware installation.

To protect against CVE-2026-120338, you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

This vulnerability was publicly disclosed on November 1, 2026. Organizations should check if they were vulnerable during the period before the patch was available.

No public exploit code has been confirmed for CVE-2026-120338 at this time. Security teams should monitor threat feeds for emerging developments and apply vendor patches proactively.

Currently, CVE-2026-120338 is not recorded in the CISA Known Exploited Vulnerabilities (KEV) catalog as being actively exploited in the wild. Security teams should still patch proactively to prevent zero-day targeting.

⚡ Security Analysis & Testing Tools