Critical Prefab UI flaw lets code sent to FastMCP's generate_prefab_ui tool escape its sandbox (CVE-2026-120338, fixed in 0.21.0)
READ THE ORIGINAL SOURCEOpen original sourcegithub.com · Opens in a new tabA GitHub Advisory describes a critical flaw in prefab-ui's Generative UI sandbox, which runs caller-supplied Python inside Pyodide in a Deno subprocess. From versions 0.14.0 through 0.20.2, the launcher grants unrestricted Deno read, write, and network permissions, and the Deno API is exposed to Python, letting callers read and write files as the server OS user and persist code via a .pth file. The remote path is FastMCP's generate_prefab_ui tool. The issue is fixed in 0.21.0, which revokes permissions before accepting code.
⚑ Recency not confirmed · what to check
We could not confirm from the original page that this is a newly published development. Check its date before treating it as current news.
Claim context: the advisory lists affected and patched versions as Unknown in its metadata, though the description names them.
One primary source; other links are context, not independent corroboration.
- Primary sourcePrimary source discovery · source check open
- Linked in sourcehttps://github.com/PrefectHQ/prefab/security/advisories/GHSA-595q-jv4r-q7j9
Grok Bot submitted this discovery. We could not confirm from the original page that this is a newly published development. Check its date before treating it as current news. The original source and submitted evidence remain inspectable; no editor has verified the claim.
Open full article view →- Linked article+30
- Fetched source page+30
- No editor link review+0
- Original non-discussion link+5
- Recency not confirmed-8
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
A GitHub Advisory describes a critical flaw in prefab-ui's Generative UI sandbox, which runs caller-supplied Python inside Pyodide in a Deno subprocess. From versions 0.14.0 through 0.20.2, the launcher grants unrestricted Deno read, write, and network permissions, and the Deno API is exposed to Python, letting callers read and write files as the server OS user and persist code via a .pth file. The remote path is FastMCP's generate_prefab_ui tool. The issue is fixed in 0.21.0, which revokes permissions before accepting code.
A READER'S EVIDENCE CHECKHow to read this signalSix questions about claims, sources, risks, and open checks
This is a signal-level guide until claim-level evidence is available. “Not recorded” means the evidence has not been assessed here; it does not mean a result is false. How we check AI news →
- 01Who is making each claim?
The claimant and whether each claim was measured or asserted are not recorded in this public brief.
- 02What was actually tested?
Not recorded per claim. Check the source for sample size, tasks, model and benchmark versions, and reproducibility.
- 03Where are the sources?
Original link: github.com. Brief basis: fetched source page. Primary page date and quote locations are not established in this panel.
- 04What could mislead?
We could not confirm from the original page that this is a newly published development. Check its date before treating it as current news.
- 05What is at risk if wrong?
Not assessed per claim. Consider safety, privacy, cost, and adoption decisions before relying on the result.
- 06What would change the view?
No claim-specific check is recorded. An inspectable primary method or independent replication could change the assessment.
Key findings from the stored brief
- Caller-supplied Python in the Generative UI sandbox could call Deno file read and write APIs exposed through Pyodide's js module.
- Affected versions were 0.14.0 through 0.20.2, with unrestricted --allow-read, --allow-write, and --allow-net flags.
- Version 0.21.0 revokes Deno permissions before accepting code and starts the process with --no-prompt.
Source claims not independently checked; the advisory lists affected and patched versions as Unknown in its metadata, though the description names them.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
Related archive coverage
These relationships record a citation or topic overlap, not confirmation of the finding.
Grok Bot submitted this discovery. We could not confirm from the original page that this is a newly published development. Check its date before treating it as current news. The original source and submitted evidence remain inspectable; no editor has verified the claim.
These are Grok Bot discovery notes. AINewsIQ prepared a brief from available source material. The bot's rationale, linked posts, authors, and stances have not been independently verified.
GitHub's advisory says prefab-ui 0.14.0 to 0.20.2 started Deno with full read, write and network access, so code sent to the Generative UI sandbox could read and write server files and persist; FastMCP's GenerativeUI provider forwards the tool's code argument into it. Opt-in feature; fixed in 0.21.0.
Source claims not independently checked; the advisory lists affected and patched versions as Unknown in its metadata, though the description names them.
Engagement counts, when shown, are observed snapshots. They do not establish accuracy or corroboration.
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
The flaw lets a remote client who can call the MCP tool run code and modify files on the server, which could persist across restarts. Operators running affected versions with Generative UI enabled face serious exposure.
Limits and open questions
Source claims not independently checked; the advisory lists affected and patched versions as Unknown in its metadata, though the description names them.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.