What happened
Prefab UI's Generative UI sandbox is documented as isolation for untrusted, caller-supplied Python — including LLM-generated UI — running the Python inside Pyodide (CPython in WebAssembly) in a Deno subprocess. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read/--allow-write/--allow-net and leaves the Deno API on the JavaScript global object; because Pyodide's js module proxies that global, the Python can call Deno.readTextFileSync/writeTextFileSync and make network calls. A caller who can supply the code can read/write files as the server OS user and persist execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards the tool's code argument into this sandbox. Fixed in 0.21.0 by revoking Deno read/write/network permissions before accepting code, starting with --no-prompt, and limiting bootstrap network access to cdn.jsdelivr.net. Confirmed on 0.20.2.
Why it matters
The Pyodide/Deno sandbox is the documented isolation boundary for untrusted, LLM-written UI code. Escaping it converts an agentic UI-generation tool into a remote code execution primitive: on an unauthenticated FastMCP server any client that can reach the server can call generate_prefab_ui and read/write files as the server user and establish persistent code execution. This is a novel agent-execution attack class (LLM-generated code sandbox escape) with a working exploit and a CVSS 10.0 rating.
Attack vector
An MCP client calls the FastMCP GenerativeUI provider's generate_prefab_ui tool with attacker-controlled Python; the code runs inside a Pyodide-in-Deno subprocess that was started with unrestricted filesystem/network permissions and a proxied Deno global, so the Python can access Deno file and network APIs, write files as the server OS user, and persist execution via a .pth file in site-packages.
Affected systems
prefab-ui 0.14.0 through 0.20.2 (fixed in 0.21.0)
Mitigation
Upgrade to prefab-ui 0.21.0 (fix commit 030f074 / PR 538), which revokes Deno read/write/network permissions before accepting code, starts with --no-prompt, and restricts bootstrap network access to cdn.jsdelivr.net. If upgrading is delayed, ensure FastMCP server authentication is configured and restrict which clients can call the GenerativeUI tool.