Prefab UI CVE-2026-120338: Update to 0.21.0 to Close a Sandbox Escape

If compromise is suspected, preserve relevant evidence before remediation. CVE-2026-120338 affects prefab-ui from 0.14.0 up to, but not including, 0.21.0 when Generative UI, Deno, and tool access align. Upgrade to 0.21.0 or later.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

A transparent digital containment cube with a cracked left wall, flowing data ribbons, a cyan shield, and an update arrow in a server room.
AI-generated editorial illustration of a sandbox boundary and security update; not official Prefect or JFrog artwork.

Prefab UI CVE-2026-120338: Update to 0.21.0 to Close a Sandbox Escape

CVE-2026-120338 affects prefab-ui versions at least 0.14.0 and below 0.21.0, but only when Generative UI is enabled, Deno is installed, and a caller can invoke the tool.[1]

PRACTICAL GUIDANCE BASED ON THE EXPOSURE MODEL • PRESERVE FIRST IF COMPROMISE IS SUSPECTED • Reporting cutoff: November 1, 2026, 22:35 UTC

The bottom line

Practical guidance based on the exposure model: If compromise is suspected, preserve relevant logs and evidence before upgrade, restart, or other remediation.[7] If the full exposure conjunction applies, upgrade prefab-ui to 0.21.0 or later.[2] Then replace or restart every running worker and container so no stale vulnerable process remains.

Verified facts

Affected rangeprefab-ui >=0.14.0 and <0.21.0.[1]
Fixed releaseVersion 0.21.0 is the fixed boundary and is available as a Prefab release and on PyPI.[1][3][5]
Potential impactA tool caller can read and write files as the server operating-system user.[1]

Why the CVSS models differ

Unauthenticated model: The CVE record assigns CVSS 3.1 10.0 Critical when GenerativeUI is enabled, Deno is installed, and the server has no authentication configured.[1]

Authenticated model: The same record assigns CVSS 3.1 9.9 Critical when the caller is authenticated and allowed to invoke tools.[1]

These are separate access models. A 10.0 score does not mean every prefab-ui deployment is anonymously reachable, and authentication does not remove the issue for an authorized tool caller.

Check the complete exposure conjunction

A deployment is in scope only when all four conditions hold: prefab-ui >=0.14.0 and <0.21.0; optional Generative UI is enabled; Deno is installed; and the caller can invoke the tool.[1]

What changed in 0.21.0

The fix revokes Deno read, write, and network permissions after bootstrap and before generated code is accepted.[1][4]

The fixed runner also documents that --no-prompt prevents later permission requests from granting those permissions again.[1]

Practical guidance based on the exposure model

  1. Inventory precisely. Record the exact installed prefab-ui version and deployment provenance.
  2. Preserve first if compromise is suspected. Preserve relevant logs and evidence before upgrade, restart, or other remediation.[7]
  3. Upgrade. Move to prefab-ui 0.21.0 or later.[2][5]
  4. Reduce exposure until upgrade. Do not register GenerativeUI on a server untrusted clients can reach.[2]
  5. Replace running processes. Replace or restart all workers and containers after deploying the fixed version.
  6. Verify the rollout. Confirm no stale workers remain and test the required Generative UI behavior after the change.

Exploitation status and limits

CVE-2026-120338 was not present in the captured CISA Known Exploited Vulnerabilities catalog version 2026.10.30 at the November 1, 2026, 22:35 UTC cutoff.[6] This is a bounded catalog observation, not proof that exploitation has never occurred.

Sources

  1. CVE Program record: CVE-2026-120338
  2. JFrog Security Research advisory JFSA-2026-001699278
  3. Prefab v0.21.0 release
  4. Prefab fix commit 030f074
  5. PyPI prefab-ui 0.21.0
  6. CISA Known Exploited Vulnerabilities Catalog
  7. NIST SP 800-61r3 (April 2025)

This report reflects the source captures available through November 1, 2026, 22:35 UTC. The CVE record references GHSA-595q-jv4r-q7j9.[1] Neither captured GitHub route was publicly readable at the cutoff, so this article does not rely on that advisory as a readable source.

Browse Articles

Latest Articles