CVE-2026-120338

The prefab-ui library (versions 0.14.0 through 0.20.2 ) contains a sandbox escape vulnerability in its Generative UI feature. The system executes caller-supplied Python code via Pyodide within a Deno subprocess. Because the launcher initializes Deno with unrestricted permissions (--allow-read , -...