The Prefab UI vulnerability, tracked as CVE-2026-120338, lets code run inside its Generative UI sandbox read and write files on the host server. It scores a perfect 10.0 on the CVSS scale, and the fix is to upgrade to prefab-ui 0.21.0 or later.
Most people are not exposed, but if you run an MCP server that turns AI output into charts or dashboards, check it today.
Here are the quick facts:
- Affected: the
prefab-uiPython package, versions 0.14.0 through 0.20.2. - Fixed in: version 0.21.0 (a 0.21.1 release followed).
- Severity: CVSS 10.0 without authentication, 9.9 with it, per JFrog.
- Disclosed: the CVE was published on November 1, 2026.
- Exploitation: no known attacks in the wild so far.
What the Prefab UI vulnerability actually is
Prefab UI is a framework from PrefectHQ. Its Generative UI feature lets a model write Python, run it in a sandbox, and get back something visual, like a chart. With FastMCP, this shows up as a tool called generate_prefab_ui.
The sandbox was supposed to keep that code locked in a box. It wasn’t. According to JFrog’s advisory, the sandbox runs Python through Pyodide inside a Deno process, and that Deno process had full read, write and network permissions.
Worse, the Deno API stayed reachable from the sandboxed Python. So a few lines of code could call Deno’s file functions and touch the real server.
That is why the score is so high. The sandbox is the safety wall between model-written code and your machine, and here the wall had a door in it.
How an attacker could use it
An attacker who can send code to the tool can read and write files as whatever user runs the server. That alone can leak secrets like API keys and config files.
It gets worse. A write to the server’s Python environment can plant a .pth file in site-packages. Python runs lines from those files every time it starts, so the attacker’s code survives and runs outside the sandbox. The DEV Community write-up describes this exact path on version 0.20.2.
In plain terms, one call to the tool could become a full takeover of the server, and the takeover could outlast a restart. That is why a CVSS 10.0 label deserves a quick look, even when the real-world exposure is small.
The same pattern shows up across AI tooling lately. We covered a similar risk in our Claude Code extension backdoor check, where a trusted tool turned out to be the way in.
Are you exposed? Conditions that matter
Not every Prefab UI install is at risk. JFrog says exploitation needs all of the following to be true:
| Condition | What it means |
|---|---|
| Generative UI is on | You registered FastMCP’s GenerativeUI provider, which exposes generate_prefab_ui. |
| Deno is installed | The sandbox needs Deno on the host. Per the DEV write-up, FastMCP can install it automatically on first use. |
| Someone can send code | Any client that can reach the server counts if there is no login. With a login, any client allowed to call tools counts. |
| Version in range | prefab-ui 0.14.0 up to, but not including, 0.21.0. |
Because FastMCP can pull Deno in on its own, don’t count on “we never installed Deno” as protection. Servers that never run untrusted code in this sandbox are not exposed, JFrog notes.
How to check and fix it in five minutes
Start by finding out what you run. These commands come from the DEV Community guide:
python -m pip show prefab-uishows your installed version.grep -rn "GenerativeUI" --include="*.py" .finds where the feature is switched on.python -m pip install --upgrade "prefab-ui>=0.21.0"applies the fix.
Also check your lockfile for a pin to 0.20.x. The fastmcp[apps] extra can bring in prefab-ui without you naming it.
The fix removes Deno’s read, write and network permissions before generated code runs, starts Deno with --no-prompt, and limits startup network access to cdn.jsdelivr.net. If you can’t upgrade yet, don’t register GenerativeUI on any server untrusted clients can reach.
One catch: upgrading does not undo a write that already happened. If your server was exposed, look through the virtualenv’s .pth files for unfamiliar import lines. If you’re still setting up MCP servers, our Safari MCP server setup guide is a good place to see what a careful setup looks like.
Frequently Asked Questions
Is the Prefab UI vulnerability being exploited right now?
Not as far as public data shows. OffSeq reports no known exploitation, no public exploit code and no CISA KEV listing, though it warns that is not proof of safety.
Which Prefab UI versions are affected?
Versions 0.14.0 through 0.20.2 of the prefab-ui package on PyPI. Version 0.21.0 and later contain the fix.
Why is the CVE-2026-120338 score 10.0?
It can be reached over the network, needs no special skill, and with no login needs no privileges. The impact on files and the server is high. JFrog scores it 9.9 when a login is required.
I only use Prefab UI for dashboards. Am I safe?
Only if you never run the Generative UI sandbox with code from outside parties. Upgrade anyway, since it takes one command.
My take: upgrade now, then review your AI tool servers
This one is easy to fix and easy to miss. The risky setup is narrow, but the people who have it are often running a quick demo server that nobody is watching. Upgrade to 0.21.0 or later today, then ask a bigger question: which of your AI tool servers run code from a model, and what can that code touch? A sandbox is only as strong as the permissions you hand it.
Leave a Reply