Prefab UI's model-UI sandbox has a CVSS-10 RCE — upgrade to 0.21
Pyodide-in-Deno isolation never locked its file permissions, so any client that can submit code owns the host. Plus: Codex may share ChatGPT's quota.
Copy markdown
Model-written UI could read and write your server
CVE-2026-120338 (CVSS 10.0, 9.9 with auth) hits PrefectHQ's prefab-ui 0.14.0–0.20.2: its Generative UI ran model-supplied Python in Pyodide inside a Deno subprocess launched with blanket --allow-read/write/net, and Pyodide's js bridge handed Deno's file API straight to the sandboxed code — JFrog planted a .pth file in site-packages to escalate to full RCE. Upgrade to 0.21.0+ (0.21.1 is current), which revokes those permissions before any code runs; until then don't expose FastMCP's generate_prefab_ui tool to untrusted callers.
Codex may soon draw from your ChatGPT quota
OpenAI is reportedly folding ChatGPT and Codex into one token-based usage pool starting in December, so chat and coding runs on Plus, Pro and Business would share a single allowance instead of separate per-product limits (Pro keeps no 5-hour cap). If it ships, a heavy Codex session eats into your chat headroom — plan the month around one budget, not two.