Prefab UI Generative UI sandbox Deno permission escape via Pyodide

This is a sandbox escape in Prefab UI's Generative UI feature. The sandbox is supposed to isolate untrusted Python code, including LLM-written UI, inside Pyodide in a Deno subprocess. But in prefab-ui 0.14.0–0.20.2, the Deno launcher starts with --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so Python code can call Deno.readTextFileSync and Deno.writeTextFileSync directly. The result is arbitrary file read/write as the server OS user, plus persistence by writing a .pth file into the server virtualenv's site-packages.

The vendor rates this CRITICAL 10, and the impact is genuinely severe when the path is reachable. But the reachable population is much smaller than the score suggests. Generative UI is opt-in, the host must have Deno installed, and the remote path requires a FastMCP server exposing the generate_prefab_ui tool with no authentication or an attacker who can call tools. FastMCP's default transport is stdio, not a network socket. So the vulnerability is a reliable RCE when the conditions align, but not a default-everywhere emergency.

Sources.

1. NVD entry for CVE-2026-120338
2. CVE.org record for CVE-2026-120338
3. prefab-ui fix pull request
4. prefab-ui fix commit
5. FastMCP repository
6. PyPI project page for prefab-ui

Run this on the host running the FastMCP server, as the same service account (or root if needed to inspect the virtualenv). Invoke as python3 check_cve_2026_120338.py. It checks the installed prefab-ui version and whether Deno is available on PATH.

#!/usr/bin/env python3
"""Check for CVE-2026-120338 in prefab-ui / FastMCP Generative UI deployments."""
import importlib.metadata
import shutil
import sys


def parse_version(v):
    parts = []
    for x in v.split("."):
        try:
            parts.append(int(x.split("-")[0].split("+")[0]))
        except ValueError:
            parts.append(0)
    while len(parts) < 3:
        parts.append(0)
    return tuple(parts[:3])


try:
    ver = importlib.metadata.version("prefab-ui")
except importlib.metadata.PackageNotFoundError:
    print("PATCHED: prefab-ui is not installed")
    sys.exit(0)

v = parse_version(ver)
min_vulnerable = (0, 14, 0)
max_vulnerable = (0, 20, 2)
if min_vulnerable <= v <= max_vulnerable:
    deno = shutil.which("deno")
    if deno:
        print(f"VULNERABLE: prefab-ui {ver} and Deno installed at {deno}")
        sys.exit(1)
    else:
        print(f"UNKNOWN: prefab-ui {ver} is vulnerable but Deno is not installed on PATH")
        sys.exit(2)
else:
    print(f"PATCHED: prefab-ui {ver} is outside vulnerable range")
    sys.exit(0)