Illustration, AI-generated from the story text. Tap a panel to read the story through it.
A sandbox meant to contain model-generated code in Prefab UI, an open-source library from Prefect for building interfaces from , did not contain it.
CVE-2026-120338, published Sunday and scored 10.0 on the scale, covers the library's Generative UI feature in versions 0.14.0 through 0.20.2: code a caller supplied ran in Deno subprocesses with excessive permissions, allowing arbitrary file reads and writes and persistent code execution on the server, with no privileges or user interaction needed.
Version 0.21.0 revokes Deno's permissions before running the code and restricts network access. No exploitation is known.
Generative UI is the pattern of letting a model write the interface on the fly, which means a that reaches the model can now reach the host.
A maximum-severity flaw in Prefab UI let AI-written code take over the server
A sandbox meant to contain model-generated code in Prefab UI, an open-source library from Prefect for building interfaces from Python, did not contain it. CVE-2026-120338, published Sunday and scored 10.0 on the CVSS scale, covers the library's Generative UI feature in versions 0.14.0 through 0.20.2: code a caller supplied ran in Deno subprocesses with excessive permissions, allowing arbitrary file reads and writes and persistent code execution on the server, with no privileges or user interaction needed. Version 0.21.0 revokes Deno's permissions before running the code and restricts network access.
No exploitation is known. Generative UI is the pattern of letting a model write the interface on the fly, which means a prompt injection that reaches the model can now reach the host. SourcesAC
Sources
- APrefab security advisory (GitHub, PrefectHQ)github.com
- CCVE-2026-120338, Prefab UI Generative UI sandbox (OffSeq Radar)radar.offseq.com
This story ran in the Afternoon Brief of November 1st 2026.