Confirmed 1 Nov 2026 · Security A one-minute read

JFrog published a maximum severity flaw in a sandbox that runs AI-written code.

The advisory, dated November 1, scores 10.0 out of 10. Code sent to Prefab UI's generative interface tool could read and write any file the server account could.

Until now

A sandbox is the thing that makes running model-written code safe.

Now

The sandbox can be the thing that hands over the host.

Why it matters

This is the pattern to watch as agents write and run code. The hole was not in a model. It was in the plumbing: a Python runtime with a live bridge to a file system interface nobody had switched off. Every agent framework shipping a code sandbox now owes its users that audit.

Established

prefab-ui versions 0.14.0 up to 0.21.0 are affected, says the advisory.
The sandbox process started with read, write and network permissions on.
Version 0.21.0, released October 26, revokes them before accepting code.

Not established

That anyone was attacked. The advisory reports no exploitation.
How many servers exposed the tool to untrusted callers.
That other agent sandboxes share the flaw. None was tested.

The five-minute readThe record, the timeline, the weight and 4 sources

The record

JFrog's security research team published advisory JFSA-2026-001699278 for CVE-2026-120338 on November 1, 2026, last updated the same day. We read it at research.jfrog.com. The vendor is PrefectHQ and the package is prefab-ui, at github.com/PrefectHQ/prefab. Affected versions are 0.14.0 and above, below 0.21.0. The fixed version is 0.21.0, which the advisory says was released on October 26, 2026. JFrog rates the issue Critical and gives a headline CVSS score of 10 for the unauthenticated case. The advisory also carries the vector CVSS:3.1 / AV:N / AC:L / PR:L / UI:N / S:C / C:H / I:H / A:H, score 9.9, for the authenticated case. The named researcher is Yuval Moravchick. The mechanism: Prefab's Generative UI sandbox executes Python in Pyodide inside a Deno subprocess, and that subprocess starts with unrestricted read, write and network permissions. The runner leaves the Deno global reachable from inside Python, and, as the advisory puts it, Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync, and the write equivalent. Code inside the sandbox therefore reads and writes the host file system as the operating system user running the server. The advisory states this was demonstrated on 0.20.2 by planting a .pth file in the server virtual environment's site-packages directory, which is a path to code execution on the next interpreter start. The remote entry point is FastMCP's GenerativeUI provider, which forwards the code argument of the generate_prefab_ui tool into the sandbox with no additional checks. The fix in 0.21.0 revokes read, write and network permission after startup, before the sandbox accepts code. JFrog's interim guidance is not to register GenerativeUI on servers reachable by untrusted clients until the upgrade is applied. The advisory reports no exploitation in the wild and gives no count of exposed deployments.

How it got here

Oct 26
PrefectHQ releases prefab-ui 0.21.0, which revokes the sandbox's read, write and network permissions before accepting code. The advisory names this as the fix.
Oct 29
A backdoored build of the Claude Code extension reaches Cursor's marketplace, affecting up to 5,000 users by the marketplace operator's estimate. The agent tool chain, not the model, is the target again.
Nov 1
JFrog publishes the advisory and the CVE, with the 10.0 score, the affected version range, the Deno permission mechanism and the .pth file demonstration on 0.20.2.

Who has to react

PrefectHQ, whose package it is; every team running FastMCP servers with GenerativeUI registered; the FastMCP maintainers, since the provider forwards code unchecked; Deno and Pyodide, whose permission models are now a security boundary other people depend on; and the agent framework vendors shipping their own code sandboxes on the same pattern.

What to watch

Would strengthen itA second maximum severity sandbox escape is published against a different agent or model-code execution framework, by March 31, 2027.
Would strengthen itA confirmed exploitation of CVE-2026-120338 in the wild is reported by a vendor, a national computer emergency team or an incident report, by June 30, 2027.
Would weaken itNo further critical sandbox escape appears in a mainstream agent framework, and this CVE's score is revised below 9.0, by June 30, 2027.

Why it weighs this much

Signal strength

CostLow

CommitmentMedium

ReversibilityHigh

PersistenceMonths

Cost is low. Publishing an advisory costs a research team its time, and the vendor had already shipped the fix 6 days earlier, so nobody paid much for this record to exist. Commitment is medium: a CVE with a named researcher, a scored vector and a reproduction is a public claim JFrog cannot quietly withdraw, but it commits no money and no product change. Reversibility is high, because scores get revised and version ranges get corrected routinely. Persistence is months, not years: the fix exists, and the signal here is about a pattern in how agent tooling is built rather than about a condition that lasts.

The words

Sandbox escape: When code that is supposed to run inside a sealed box reaches the machine outside it. The box is the only safety measure, so an escape removes all of it.
Pyodide: Python compiled to run inside a JavaScript engine. It is the usual way to run untrusted Python in a browser or server runtime without a separate operating system process.
CVSS: The industry severity scale, 0 to 10. A 10 means remotely exploitable, no privileges needed, with full loss of confidentiality, integrity and availability.
Generative UI: A feature where a model writes interface code and the server runs it immediately. The code is written by the model, so nobody reviews it before execution.

Sources

Your call

Which explanation do you believe?

A call is final. Other people's calls show after yours.