External risk intelligence

Prefab UI Generative UI Sandbox Arbitrary File Read Write

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-120338

The vulnerability exists in a generative UI sandbox environment typically exposed via FastMCP servers. As these services are designed to act as web or API interfaces for LLM-driven applications, they are frequently deployed as internet-facing network endpoints. If an MCP server is configured without authentication, the vulnerable code execution path is directly accessible from the public internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves the Generative UI sandbox, which runs untrusted code in a protected environment. However, a flaw in versions 0.14.0 through 0.20.2 allows that code to bypass isolation and interact with the underlying operating system, potentially leading to unauthorized file access and code execution on the server. The main concern is confirming relevance and exposure to this risk.

Code sandbox can read/write server files.
Affects servers running specific UI versions.
Confirm if this tool is deployed and used.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability if they can reach the Generative UI sandbox, which is often exposed via FastMCP servers. By supplying malicious Python code, an attacker can trick the sandbox into executing arbitrary commands on the server's operating system. This could allow them to read or write files, and even persist their access by planting malicious code.

Unauthenticated or authenticated tool access required.
Supply Python code to the Generative UI sandbox.
Server compromise, arbitrary file access, and code execution.

Live Threat

Current exploitation, exposure, and threat context

A malicious actor could potentially read and write arbitrary files on the server by supplying crafted Python code to the Generative UI sandbox. This occurs when the underlying Deno subprocess is launched with broad read, write, and network permissions, and the Python environment can then leverage the Deno API to interact with the server's file system. Persistent code execution may be possible by writing a `.pth` file to the server's virtual environment.

Server files and code execution.
Supplied Python code accesses server.
Unrestricted server access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The affected technology, Prefab UI's Generative UI sandbox, likely falls under the responsibility of platform teams or application owners who manage FastMCP deployments. The initial practical step is to identify all FastMCP servers running Prefab UI, confirm their network exposure and business criticality, and then locate the accountable owner for each instance to plan remediation.

Platform or application owners should own.
Verify network exposure and criticality.
Plan phased remediation by risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Prefab UI Generative UI sandbox?

Prefab UI provides a sandbox that allows applications to safely execute untrusted Python code, such as UI elements generated by Large Language Models. It runs this code inside a Pyodide environment—Python compiled to WebAssembly—within a Deno subprocess. This setup is designed to isolate the execution from the server's main operating system.

What does CWE-94 mean for CVE-2026-120338?

This CVE involves Improper Control of Generation of Code (CWE-94), alongside privilege and protection issues. Essentially, the sandbox intended to restrict code failed to block it from using Deno's powerful system-level functions. Because the sandbox environment remained connected to these functions, the code inside could interact with the server's files as if it were a local user, bypassing the intended safety barriers.

Does my code need to be malicious to trigger this?

The vulnerability is triggered whenever the sandbox environment is improperly restricted. It does not require a specific trigger other than the ability to supply code to the sandbox. If you are not using the Generative UI feature, or if you are running version 0.21.0 or later where these permissions have been strictly revoked, your environment is not susceptible to this specific path.

How do I know if my system is reachable?

Halo Surface Signal indicates that because FastMCP servers are often deployed as web or API endpoints for LLM applications, they are frequently exposed to the internet. If your server is reachable from the public internet and configured without authentication, the sandbox is directly accessible, increasing the risk. You should review your network perimeter to see if these tools are exposed.

How should I respond to this vulnerability?

First, verify if your environment is running an affected version of Prefab UI (0.14.0 through 0.20.2). If you identify these versions, prioritize upgrading to version 0.21.0, which implements stricter permission controls. Coordinate with your platform or application teams to audit your FastMCP deployments, identify who owns them, and verify their current network exposure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.