Skip to content
Threat Feed
Subscribe

Vendor

Prefab

1 brief RSS
critical advisory

Prefab UI: Arbitrary code execution via Generative UI sandbox (CVE-2026-120338)

Prefab UI versions 0.14.0 through 0.20.2 contain a sandbox escape vulnerability where caller-supplied Python code executed in a Deno subprocess can access unrestricted filesystem and network permissions via the exposed Deno API.

prefab-ui
1c