A sandbox that cannot keep model-written code away from the host is not a sandbox. The Injection reports that JFrog, on November 1, 2026, published CVE-2026-120338 against Prefab UI, scoring it CVSS 10.0 on an unauthenticated server. Prefab’s Generative UI sandbox “ran model-written Python with unrestricted Deno read, write and network permissions, so generated code could reach host files.” The fix is prefab-ui 0.21.0, “the package that fastmcp[apps] pulls in.”
Quick Take
- Product: Prefab UI, used (among other paths) via the FastMCP
appsextra as a Generative UI provider. - Bug: The Deno-based sandbox left file and network permissions open, so LLM-generated Python could read and write host files. JFrog scores it 10.0 when the server is unauthenticated.
- Fix: Upgrade prefab-ui to 0.21.0 or later.
- Until then: Remove the GenerativeUI provider from any FastMCP server that does not need it, require authentication on servers that keep it, and check exposed hosts for unexpected
.pthfiles in the virtualenv’s site-packages.
What happened
Generative UI tools ask a model to write code, then run that code to draw an interface. That is a classic “do not run untrusted code” problem, which is why Prefab put the Python inside a Deno sandbox. JFrog’s finding is that the sandbox was started with file and network permissions left open, so the generated code could reach the host. On a server with no authentication, that is a straight unauthenticated path to the machine — hence the 10.0.
The Injection’s week-44 summary also flags a practical forensic step: look for unexpected .pth files in site-packages, a common persistence trick once an attacker can write into a Python environment.
What you should do
- Upgrade to prefab-ui 0.21.0+ everywhere, including transitive installs from FastMCP.
- If you cannot upgrade immediately, disable the GenerativeUI provider and do not expose the server without authentication.
- Inspect exposed hosts for unexpected
.pthfiles and other site-packages changes; rebuild environments that were public before the patch.
What it means
“We run the model in a sandbox” is becoming a marketing sentence. A CVSS 10.0 on a Generative UI helper is a reminder that the sandbox configuration is the product. FastMCP users who never installed Prefab on purpose may still have pulled it in as an extra. Check the lockfile, not just the README.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on The Injection’s week-44 summary of JFrog’s November 1, 2026 advisory for CVE-2026-120338. i10x did not test Prefab UI.
