Prefab UI CVSS 10 RCE: FastMCP GenerativeUI servers exposed
A Pyodide-to-Deno bridge lets any caller read or write host files. Versions 0.14-0.20.2 are hit; 0.21.0 plugs it. Patch now, or unregister GenerativeUI.
Copy markdown
A sandbox that reads /etc/passwd
Prefab UI's GenerativeUI runs caller-supplied Python inside Pyodide, but it launches the Deno host with full read/write/network and leaves Deno's API on the JS global object. Pyodide's js module exposes it, so sandboxed code just calls Deno.readTextFileSync and writeTextFileSync on the host. JFrog scores it CVSS 10.0 - the maximum.
Check if your MCP server is exposed
The exposure route is FastMCP's GenerativeUI provider: its generate_prefab_ui tool hands the code argument straight to the sandbox with no extra checks. On an unauthenticated FastMCP server, any client that can reach it gets RCE; with auth, any caller allowed to invoke tools does. It's opt-in and needs Deno installed, so servers that never enabled it are clear.
Patch to 0.21.0, or pull the provider
Fixed in prefab-ui 0.21.0 (shipped Oct 26), which revokes filesystem and network permissions after startup, before it accepts any code. The affected range is 0.14.0 through 0.20.2. Until you upgrade, don't register GenerativeUI on a server untrusted clients can reach.
The persistence twist on 0.20.2
It isn't just one-off file reads: on 0.20.2 an attacker can drop a .pth file into your virtualenv's site-packages, so the next Python process in that env auto-runs their import. If a vulnerable version was ever reachable, audit site-packages - don't just bump the version.