AG-UI.AIGENERATIVE UI INTELLIGENCE
中文Subscribe ↗
FrameworksOfficial

Prefab UI generative-UI sandbox escaped to the host; 0.21.0 revokes Deno permissions

CVE-2026-120338, published November 1, reports that Prefab UI 0.14.0 through 0.20.2 ran model- or caller-supplied Python in Pyodide while leaving a Deno API with read, write, and network permissions on the JavaScript global. Code could use Pyodide's js proxy to read or write host files and persist execution through a virtualenv .pth file. Version 0.21.0 revokes filesystem and network permissions before accepting generated code and starts Deno with --no-prompt.

Event Source published Indexed Verified

Why it matters

The issue is a concrete counterexample to treating WebAssembly or browser-derived runtimes as an isolation boundary. When generative UI executes model-produced code, the effective boundary is the host process, tool authorization, network exposure, and the permissions present when generated code begins.

A closer look

The GitHub Advisory Database rates the issue Critical at CVSS 3.1 10.0. A typical remote path is FastMCP's GenerativeUI provider forwarding the generate_prefab_ui code argument into the sandbox. Without authentication, a client that can reach the server can call it; with authentication, any client authorized for that tool can still reach the path. The issue was confirmed on 0.20.2. Fix PR #538 merged October 25 and shipped in 0.21.0 on October 26: bootstrap network access is limited to cdn.jsdelivr.net, Deno read/write/network permissions are revoked after runtime and Prefab sources load, and permission prompts are disabled.

Who this is for

Platform, security, and infrastructure teams running Prefab UI, FastMCP GenerativeUI, or any Pyodide/Deno path that executes model-produced code.

Original sources

Revisions & corrections (1)

— A newly discovered, evidence-complete critical vulnerability directly affects optional generative-UI code execution; the advisory, affected range, exploit path and upstream fix are documented.

Related events

Frameworks

AG-UI Kotlin 0.5.0 aligns with 1.0 through interrupts, activities, multimodality, and strict state boundaries

AG-UI released Kotlin core, client, and tools 0.5.0 on November 5. The SDK now targets AG-UI 1.0 with REASONING events, interrupt/resume outcomes, ACTIVITY snapshots and deltas, tool errors, and multimodal user messages, while adding browser Wasm and macOS Arm64 targets and tightening event, input, and RFC 6902 state validation.

AG-UI official immutable November 5 releaseOfficial
Frameworks

AI SDK 7.0.163 honors telemetry content controls and preserves Google streamed tool order and signature history

Vercel released AI SDK 7.0.163 on November 5. `recordInputs` and `recordOutputs` now govern content delivered to integrations and the `ai:telemetry` channel, filtering prompts, tool inputs, response text, and raw span results while retaining application results such as usage. The same release preserves the order of text, complete function calls, and thought signatures in streamed Google responses and across replayed history.

Vercel AI SDK official release and linked commitsOfficial
Frameworks

json-render 0.22 streams one generative-UI catalog into native Slack and Teams cards

json-render 0.22.0, released November 4, adds `@json-render/chat`. One component catalog can become a Chat SDK card; `streamCard` edits a thread message as elements arrive, while `toCard` validates the final card against component schemas and optional platform limits. The official example previews Slack Block Kit and Teams Adaptive Cards.

json-render official release and merged Chat SDK renderer pull requestOfficial