prefab-ui vulnerabilities

CVEs whose affected-version data names the prefab-ui package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120338Critical· 10.0

5d ago

Prefab UI Pyodide sandbox escape to host RCE

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.…

▾ MidnightPrefectHQ · prefab-uiEPSS 0.77%via CVEORG