On November 1, 2026, security firm JFrog published a flaw with the top severity score, CVSS 10.0. It sits in a tool built to make AI-written code safe to run: the Generative UI sandbox in Prefab UI, an open-source library from PrefectHQ. Versions 0.14.0 to 0.20.2 are affected. Version 0.21.0 fixes it.
A Locked Room With the Key Inside
Generative UI lets an AI model write a small Python program that draws a screen. The server runs that code to check it. Because a model wrote it, the code counts as untrusted, so it runs in a sandbox, a sealed area that keeps code away from the rest of the computer.
The sandbox has two layers. Pyodide is Python compiled to WebAssembly, which can do only what its host hands it. Deno is a program that runs JavaScript and blocks file and network access unless someone grants permission.
Here is where it failed. JFrog says Prefab gave Deno full permission to read files, write files and use the network. It also left Deno’s own commands within reach of the bridge Pyodide offers between Python and JavaScript. It is like building a strong cell and hanging the keys inside it.
What the Flaw Allowed
Anyone who could send code to the sandbox could read and write files as the server’s user. JFrog also showed the access could be made to last. The 10.0 score assumes no login. With a login, the same bug scores 9.9.
Reaching it is easy in the usual setup. A tool in FastMCP, a library that lets AI models call tools on a server, passes the code straight in with no extra check. Generative UI is optional and needs Deno installed, so many servers are not exposed.
JFrog describes a direct call to that tool. My own reading is that a model could also be tricked: after reading a poisoned web page, it might write harmful code and send it down the same path. JFrog did not test this.
The Fix, and a Quiet Release
JFrog says it reported the bug on August 5. PrefectHQ released 0.21.0 on October 26. It removes file and network permissions before the sandbox accepts code, and stops that code from asking for them back. The CVE record says no advisory text came with the release, and the CVE followed six days later. I found no report of attacks.
What to Do Differently
A sandbox is only as strong as what you hand it. My own advice, not JFrog’s: give code the fewest permissions it needs. Run it as a separate low-privilege user or in a container, with no network and no view of your files or secrets. Keep code-running tools closed to people who have not logged in. Then test the walls yourself first.
My reading is that WebAssembly was not the weak point. The escape used a standard Pyodide bridge that the setup left open. The wall held. What went wrong was what the builders put inside it.
