Prefab UI CVE-2026-120338

Requires the opt-in Generative UI feature to be enabled, Deno installed on the host, and a reachable path that forwards caller-supplied code into the Pyodide/Deno sandbox - the documented path is FastMCP's GenerativeUI provider exposing the generate_prefab_ui tool. On a FastMCP server with no authentication configured, exploitation is remote and unauthenticated by any client that can reach the server; with authentication enabled, it is limited to clients already permitted to call tools. Affected versions are prefab-ui 0.14.0 through 0.20.2 (confirmed on 0.20.2). Limiting factors: the feature is not enabled by default, the Deno runtime dependency must be present, and network reachability to the MCP endpoint is required; these narrow real-world exposure despite the maximal CVSS.

All severity signals point the same direction: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a network-reachable, low-complexity, unauthenticated sandbox escape with scope change and full confidentiality/integrity/availability loss, and the vuln.today Decision label is act_now with a vendor patch available - so this should be treated as a real, high-priority issue, not a high-CVSS-but-low-risk artifact. The mechanism is concretely documented by the reporter (JFROG) and corroborated by the vendor advisory and PR 538 diff: Pyodide's js module proxies the Deno global, letting caller-supplied Python call Deno.readTextFileSync/writeTextFileSync because the launcher granted unrestricted --allow-read/--allow-write/--allow-net, yielding file read/write as the server OS user and persistent code execution via a .pth file in site-packages. The important counterweight is deployment conditions, not mechanism: the feature is opt-in, the host must have Deno installed, and the PR:N rating assumes the documented no-authentication FastMCP deployment - with authentication, the attacker must be a client already allowed to call tools, so real-world exposure is narrower than the raw 10.0 implies. No EPSS score is provided and the CVE is not listed in CISA KEV in the supplied data; there is no public exploit identified at time of analysis, so the act_now urgency rests on severity and the fully-disclosed technique rather than on observed exploitation.

A FastMCP server runs the GenerativeUI provider (Generative UI enabled, Deno installed) and registers the generate_prefab_ui tool with no authentication configured. An attacker who can reach the server calls that tool with Python that uses Pyodide's js proxy to invoke Deno.writeTextFileSync, writing a malicious .pth file into the virtualenv's site-packages to gain persistent code execution as the server OS user. No public exploit code is identified at time of analysis, though the technique is fully described in the advisory.