{"schema":"sanctity-signal/0.2","record_type":"signal","id":"jfrog-prefab-sandbox-rce-e069","domain":"security","drop_id":"signal-e069","occurred_at":"2026-11-01","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"JFrog","action_type":"publication of security advisory JFSA-2026-001699278 for CVE-2026-120338, a maximum severity sandbox escape in the Prefab UI generative interface tool that runs caller-supplied Python","observed":"JFrog's security research team published advisory JFSA-2026-001699278 for CVE-2026-120338 on November 1, 2026, last updated the same day. We read it at research.jfrog.com. The vendor is PrefectHQ and the package is prefab-ui, at github.com/PrefectHQ/prefab. Affected versions are 0.14.0 and above, below 0.21.0. The fixed version is 0.21.0, which the advisory says was released on October 26, 2026. JFrog rates the issue Critical and gives a headline CVSS score of 10 for the unauthenticated case. The advisory also carries the vector CVSS:3.1 / AV:N / AC:L / PR:L / UI:N / S:C / C:H / I:H / A:H, score 9.9, for the authenticated case. The named researcher is Yuval Moravchick. The mechanism: Prefab's Generative UI sandbox executes Python in Pyodide inside a Deno subprocess, and that subprocess starts with unrestricted read, write and network permissions. The runner leaves the Deno global reachable from inside Python, and, as the advisory puts it, Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync, and the write equivalent. Code inside the sandbox therefore reads and writes the host file system as the operating system user running the server. The advisory states this was demonstrated on 0.20.2 by planting a .pth file in the server virtual environment's site-packages directory, which is a path to code execution on the next interpreter start. The remote entry point is FastMCP's GenerativeUI provider, which forwards the code argument of the generate_prefab_ui tool into the sandbox with no additional checks. The fix in 0.21.0 revokes read, write and network permission after startup, before the sandbox accepts code. JFrog's interim guidance is not to register GenerativeUI on servers reachable by untrusted clients until the upgrade is applied. The advisory reports no exploitation in the wild and gives no count of exposed deployments.","evidence":{"status":"verified","note":null,"sources":[{"role":"primary","label":"JFrog advisory JFSA-2026-001699278, CVE-2026-120338, prefab-ui remote code execution via a Pyodide js bridge to Deno, Nov 1, 2026","url":"https://research.jfrog.com/vulnerabilities/prefab-ui-is-vulnerable-to-remote-code-execution-via-a-pyodide-js-bridge-to-deno-cve-2026-120338-jfsa-2026-001699278/"},{"role":"corrob","label":"VulDB entry 429663 for CVE-2026-120338, PrefectHQ Prefab UI generative interface sandbox","url":"https://vuldb.com/vuln/429663"},{"role":"corrob","label":"The Hacker Wire: CVE-2026-120338, Prefab UI generative sandbox escape via Deno permission bypass","url":"https://www.thehackerwire.com/cve-2026-120338-prefab-ui-generative-sandbox-rce-via-deno-permission-bypass/"},{"role":"corrob","label":"DEV Community write-up: Prefab UI's Python sandbox could read and write your server's files, upgrade to 0.21","url":"https://dev.to/gabrielanhaia/prefab-uis-python-sandbox-could-read-and-write-your-servers-files-upgrade-to-021-1em5"}]},"strength":{"cost":"Low","commitment":"Medium","reversibility":"High","persistence":"Months","rationale":"Cost is low. Publishing an advisory costs a research team its time, and the vendor had already shipped the fix 6 days earlier, so nobody paid much for this record to exist. Commitment is medium: a CVE with a named researcher, a scored vector and a reproduction is a public claim JFrog cannot quietly withdraw, but it commits no money and no product change. Reversibility is high, because scores get revised and version ranges get corrected routinely. Persistence is months, not years: the fix exists, and the signal here is about a pattern in how agent tooling is built rather than about a condition that lasts."},"shift":{"prior":"A sandbox is the thing that makes running model-written code safe.","action":"JFrog's security research team published advisory JFSA-2026-001699278 for CVE-2026-120338 on November 1, 2026, last updated the same day. We read it at research.jfrog.com. The vendor is PrefectHQ and the package is prefab-ui, at github.com/PrefectHQ/prefab. Affected versions are 0.14.0 and above, below 0.21.0. The fixed version is 0.21.0, which the advisory says was released on October 26, 2026. JFrog rates the issue Critical and gives a headline CVSS score of 10 for the unauthenticated case. The advisory also carries the vector CVSS:3.1 / AV:N / AC:L / PR:L / UI:N / S:C / C:H / I:H / A:H, score 9.9, for the authenticated case. The named researcher is Yuval Moravchick. The mechanism: Prefab's Generative UI sandbox executes Python in Pyodide inside a Deno subprocess, and that subprocess starts with unrestricted read, write and network permissions. The runner leaves the Deno global reachable from inside Python, and, as the advisory puts it, Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync, and the write equivalent. Code inside the sandbox therefore reads and writes the host file system as the operating system user running the server. The advisory states this was demonstrated on 0.20.2 by planting a .pth file in the server virtual environment's site-packages directory, which is a path to code execution on the next interpreter start. The remote entry point is FastMCP's GenerativeUI provider, which forwards the code argument of the generate_prefab_ui tool into the sandbox with no additional checks. The fix in 0.21.0 revokes read, write and network permission after startup, before the sandbox accepts code. JFrog's interim guidance is not to register GenerativeUI on servers reachable by untrusted clients until the upgrade is applied. The advisory reports no exploitation in the wild and gives no count of exposed deployments.","update":"The sandbox can be the thing that hands over the host."},"inference":{"established":["prefab-ui versions 0.14.0 up to 0.21.0 are affected, says the advisory.","The sandbox process started with read, write and network permissions on.","Version 0.21.0, released October 26, revokes them before accepting code."],"unknown":["That anyone was attacked. The advisory reports no exploitation.","How many servers exposed the tool to untrusted callers.","That other agent sandboxes share the flaw. None was tested."]},"narrative":{"hook":"JFrog published a maximum severity flaw in a sandbox that runs AI-written code.","plain":"The advisory, dated November 1, scores 10.0 out of 10. Code sent to Prefab UI's generative interface tool could read and write any file the server account could.","story":["This is the pattern to watch as agents write and run code. The hole was not in a model. It was in the plumbing: a Python runtime with a live bridge to a file system interface nobody had switched off. Every agent framework shipping a code sandbox now owes its users that audit."],"trail":[{"d":"OCT 26","t":"PrefectHQ releases prefab-ui 0.21.0, which revokes the sandbox's read, write and network permissions before accepting code. The advisory names this as the fix."},{"d":"OCT 29","t":"A backdoored build of the Claude Code extension reaches Cursor's marketplace, affecting up to 5,000 users by the marketplace operator's estimate. The agent tool chain, not the model, is the target again."},{"d":"NOV 1","t":"JFrog publishes the advisory and the CVE, with the 10.0 score, the affected version range, the Deno permission mechanism and the .pth file demonstration on 0.20.2."},{"d":"Reacts","r":true,"t":"PrefectHQ, whose package it is; every team running FastMCP servers with GenerativeUI registered; the FastMCP maintainers, since the provider forwards code unchecked; Deno and Pyodide, whose permission models are now a security boundary other people depend on; and the agent framework vendors shipping their own code sandboxes on the same pattern."}],"glossary":[{"term":"Sandbox escape","def":"When code that is supposed to run inside a sealed box reaches the machine outside it. The box is the only safety measure, so an escape removes all of it."},{"term":"Pyodide","def":"Python compiled to run inside a JavaScript engine. It is the usual way to run untrusted Python in a browser or server runtime without a separate operating system process."},{"term":"CVSS","def":"The industry severity scale, 0 to 10. A 10 means remotely exploitable, no privileges needed, with full loss of confidentiality, integrity and availability."},{"term":"Generative UI","def":"A feature where a model writes interface code and the server runs it immediately. The code is written by the model, so nobody reviews it before execution."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"Agent plumbing is the attack surface","text":"The model is contained; the runtime around it is not, and shipped fast.","abstain":false},{"id":"b","label":"One package, one mistake","text":"A permission flag left on in one young library. Nothing wider follows.","abstain":false},{"id":"c","label":"Deliberate speed over safety","text":"Generative interface features shipped because rivals shipped them, with the audit deferred.","abstain":false},{"id":"d","label":"Normal software lifecycle","text":"New libraries get critical findings. The fix landed before disclosure, as designed.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"A second maximum severity sandbox escape is published against a different agent or model-code execution framework, by March 31, 2027.","window_end":"2027-03-31","state":"unresolved"},{"linked_interpretation":"a","direction":"strengthens","observable_event":"A confirmed exploitation of CVE-2026-120338 in the wild is reported by a vendor, a national computer emergency team or an incident report, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"},{"linked_interpretation":"a","direction":"weakens","observable_event":"No further critical sandbox escape appears in a mainstream agent framework, and this CVE's score is revised below 9.0, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"}]}