The security boundary promised by a WebAssembly or Pyodide sandbox depends on what host objects are exposed to it. In the reported path, a caller able to supply Python to a generative UI tool can bridge into js and reach Deno host APIs, potentially reading or writing files through the service account. This is a reported vulnerability mechanism, not evidence…
Inspect the ClaimsCase · DiggingBeagle record
Prefab UI generative sandbox exposed host Deno APIs to supplied Python code
An unreviewed advisory reports AI-generated Python running in Pyodide with access to Deno host primitives under excessive permissions.
Scope
An unreviewed advisory reports a generated-code host bridge in opt-in Generative UI when Deno is installed and a caller can provide code, affecting prefab-ui 0.14.0 through 0.20.2; a fix is reported in 0.21.0, with no verified production victim count.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade D
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The only available supporting evidence is the reporter's or advisory author's own account; independent reproduction has not been shown. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-PREFAB-PYODIDE-DENO-ESCAPE-A · GitHub Advisory GHSA-3g72-rrqc-f76c, Prefab UI Pyodide sandbox
At a glance
An interpreter sandbox is only as narrow as its exported host objects and the privileges of its process.
Read the implicationsGitHub advisory is unreviewed; caller prerequisites, upstream patch status and actual exploitation require independent confirmation. The unreviewed advisory does not establish production victims or a fully independent reproduction of the reported 0.21.0 fix.
Limits and uncertaintyFull account
The security boundary promised by a WebAssembly or Pyodide sandbox depends on what host objects are exposed to it. In the reported path, a caller able to supply Python to a generative UI tool can bridge into js and reach Deno host APIs, potentially reading or writing files through the service account. This is a reported vulnerability mechanism, not evidence that arbitrary remote users can submit code to every installation or that a production host was breached.
The advisory gives concrete prerequisites: the Generative UI feature is opt-in, Deno must be installed, and a caller needs access to the code-supplying tool. Within those conditions, the Python guest can reach the Deno JavaScript global bridge and call host file APIs despite the apparent Pyodide sandbox. The source identifies prefab-ui 0.14.0 through 0.20.2 and a reported fix in 0.21.0 that revokes Deno permissions before generated code starts. This is a host-bridge authorization problem, not evidence that every WebAssembly runtime can escape an operating-system sandbox.
Mechanism and trust boundary
- 01
Invoke a generative UI tool
Caller-supplied or generated Python is handed to a Pyodide guest.
Boundary: Agent-produced source into guest interpreter
- 02
Reach host bridge
The guest accesses exposed js objects that include Deno capabilities.
Boundary: Wasm guest into host runtime
- 03
Perform host side effects
Host permissions can exceed the intended guest sandbox scope.
Boundary: Sandbox label into filesystem/network authority
Claims & evidence
CLM-2026-NOV02-PREFAB-PYODIDE-DENO-ESCAPE-AThe advisory states that Prefab UI 0.14.0 through 0.20.2 exposed Deno APIs to guest code through the Pyodide js bridge while the host process ran with filesystem and network permissions.supported
Basis: reported finding
- supportsGitHub Advisory GHSA-3g72-rrqc-f76c, Prefab UI Pyodide sandboxprimary disclosure
Advisory, affected versions and Pyodide js-to-Deno host access
CLM-2026-NOV02-PREFAB-PYODIDE-DENO-ESCAPE-BThe unreviewed Prefab advisory reports that generated Python could reach host Deno file APIs in versions 0.14.0 through 0.20.2 and identifies 0.21.0 as the fixed release.supported
Basis: reported finding
- supportsGitHub Advisory GHSA-3g72-rrqc-f76c, Prefab UI Pyodide sandboxprimary disclosure
GHSA-3g72-rrqc-f76c, Description, affected versions, and reported fix
Implications
An interpreter sandbox is only as narrow as its exported host objects and the privileges of its process.
Controls and mitigations
- Remove unrestricted host bridges, constrain Deno permissions and run generated code under a separately isolated, audited execution identity.
- Use the reported fixed version, remove Deno host objects from guest reach and test file/network permission revocation after bootstrap, not just at process launch.
Unknowns and contradictions
- GitHub advisory is unreviewed; caller prerequisites, upstream patch status and actual exploitation require independent confirmation.
- The unreviewed advisory does not establish production victims or a fully independent reproduction of the reported 0.21.0 fix.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214