Skip to content

CVE record · 1 source

CVE-2026-120338

CVSS 10.0

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess.

Vendor: PrefectHQ
Product: prefab-ui
CVSS v3.1: 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94, CWE-269, CWE-693

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

38

CVE NVD 2h ago

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess.

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From…

CVSS 10.0 Fix available CVE-2026-120338 PrefectHQ