Prefab Ui
Monthly
The Generative UI sandbox in prefab-ui 0.14.0 through 0.20.2 does not actually isolate caller-supplied Python: the Deno subprocess is launched with unrestricted --allow-read, --allow-write and --allow-net, and Pyodide's js module exposes the Deno global to sandboxed Python, so code can call Deno.readTextFileSync and Deno.writeTextFileSync as the server OS user, and can persist execution by writing a .pth file into the server virtualenv's site-packages. The documented remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox; on a FastMCP server with no authentication configured, any client that can reach the server can invoke it (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0). Exposure is narrowed by the feature being opt-in and requiring Deno on the host, but the dedicated advisory, an act_now decision label and a vendor-released fix in 0.21.0 make this a high-priority item; no public exploit was identified at time of analysis.
The Generative UI sandbox in prefab-ui 0.14.0 through 0.20.2 does not actually isolate caller-supplied Python: the Deno subprocess is launched with unrestricted --allow-read, --allow-write and --allow-net, and Pyodide's js module exposes the Deno global to sandboxed Python, so code can call Deno.readTextFileSync and Deno.writeTextFileSync as the server OS user, and can persist execution by writing a .pth file into the server virtualenv's site-packages. The documented remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox; on a FastMCP server with no authentication configured, any client that can reach the server can invoke it (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0). Exposure is narrowed by the feature being opt-in and requiring Deno on the host, but the dedicated advisory, an act_now decision label and a vendor-released fix in 0.21.0 make this a high-priority item; no public exploit was identified at time of analysis.