Prefab UI, the generative-UI library behind FastMCP's GenerativeUI provider, had a 10.0 in the sandbox that runs LLM-written UI code: from 0.14.0 through 0.20.2, that code could read and write files as the server's user. The fix shipped on October 26 in 0.21.0, whose release notes call it a regression fix, and a CVE from JFrog said why on Sunday. If you've turned on Generative UI in a FastMCP server, upgrade prefab-ui by name, because FastMCP's apps extra still accepts 0.18.0.

A scanner raises none of this table this morning. Prefab's and network-ai's CVEs are unreviewed records with no package, and the network-ai, ag-ui-adk, Authlib and Pillow advisories exist only on their repositories.

Worth your morning

Prefab UI: a sandbox that wasn't one. CVE-2026-120338 (JFrog, 10.0 on v3.1) covers Prefab's Generative UI sandbox, which runs caller-supplied Python in Pyodide inside a Deno subprocess and is documented as isolation for untrusted code, LLM-written UI included. From 0.14.0 through 0.20.2 the subprocess kept full file and network permissions, so whoever supplies the code can read and write files as the server's OS user and, through that, run code on the host. The usual way in is FastMCP's GenerativeUI provider (FastMCP 3.2.0 onwards, apps extra), which registers a generate_prefab_ui tool and passes the tool's code argument to the sandbox. On a FastMCP server without authentication, any client that can reach it can call that tool. Generative UI is opt-in, and the host needs Deno installed.

0.21.0 drops the file and network permissions before the sandbox accepts code and limits its startup download to one CDN; both changes are in the code at the v0.21.0 tag and absent at v0.20.2. The release notes file the change under "fix renderer and sandbox regressions", and the project's own advisory, which the CVE links, isn't public yet. FastMCP's apps extra declares prefab-ui>=0.18.0, so a lockfile resolved before October 26 stays on 0.20.2 until you upgrade prefab-ui by name. prefab-ui is downloaded about 158,000 times a week.

network-ai: a fix four releases above the one scanners know. VulnCheck filed four CVEs this morning for advisories the TypeScript agent-orchestration framework published on October 17, minutes after 5.15.5 fixed them. Two path traversals let a caller who controls a job ID or a recorded-session name read, overwrite or delete .json files elsewhere on the host, credentials and policy files included (8.8 each, from 5.13.4). A third escapes the input sanitizer's base directory (7.5), and the A2A server accepts task operations without a token when no secret is configured (7.3, from 5.14.0). This digest last covered network-ai on June 23, at 5.9.1. Since then the project has published eleven advisories, fixed across 5.13.4, 5.15.1, 5.15.2 and 5.15.5, nine of them rated high. GitHub's reviewed database has none of the eleven, and its newest record for the package ends at 5.12.2. Upgrade to 5.17.1 (October 27). It's a small package, about 2,700 downloads a week.

AG-UI: one advisory this digest missed, and five CVEs whose range stops too early. The AG-UI repository published a 7.5 for its Python ADK middleware on October 21 (GHSA-chx5): from 0.3.0 through 0.10.0, client-supplied state could write to ADK's shared application and user state, and the changed values could show up in other sessions and steer agent behaviour where an app uses that state in prompts or tool logic. 0.11.0 fixed it the same morning. The advisory's workaround, if you can't upgrade, is to drop every app: and user: key from untrusted state before it reaches the middleware. The repository wasn't on this digest's watch list; it is now.

On Sunday VulDB added five CVEs against the TypeScript client (@ag-ui/client, 2 million downloads a week), scored 4.3 to 6.3 and all written as "up to 0.0.58", the release that was current when the issues were filed in August. Two, on framing-buffer limits and schema checks for protobuf events (CVE-2026-120235 and CVE-2026-120236), are fixed in 1.0.0 (September 17). The other three are open pull requests: HttpAgent follows redirects with the run request's credentials (CVE-2026-120233, 5.3, PR 2575), error responses are read into memory whole (CVE-2026-120234), and interrupts without an expiry never expire (CVE-2026-120237). So 1.0.3, the current release, still has all three, while a scanner matching the CVE range calls it clean. Until PR 2575 lands, point HttpAgent only at endpoints you control.

Authlib: the ID-JAG grant issued more scope than the identity provider signed. GHSA-f3fg (7.3) covers Authlib 1.9.0 and 1.9.1 acting as an authorization server with the ID-JAG grant enabled. A confidential client with valid credentials and a valid ID-JAG for a user could get a broader scope than the identity provider granted, where the client's registration and local policy allowed it. ID-JAG is an opt-in draft grant, and servers that haven't enabled it aren't affected. 1.9.2 reached PyPI on Sunday at 20:39 UTC, six minutes before the advisory. For anyone serving the grant, that moves the Authlib floor from October 28's 1.9.1 to 1.9.2. Open WebUI 0.12.5 still pins 1.7.2, below this range and inside that day's nine.

Pillow: two more TIFF advisories, same 13.0.0. The maintainers published two advisories overnight against every release through 12.3.0, both fixed in 13.0.0 (October 16): a heap buffer overflow when an application saves user-supplied images as TIFF through libtiff (GHSA-xcvg, high), and memory exhaustion from small TIFF or JPEG uploads, or from reading EXIF data on uploaded images, that the decompression-bomb check doesn't catch (GHSA-wqgw, medium). On 13.0.0 there's nothing to do. Since October 21, Streamlit has lifted its cap to <14 and Open WebUI 0.12.5 pins 13.0.0, but Gradio 6.31.0 still requires pillow<13.0, so a Gradio app can't reach either fix by upgrading Gradio.

Also on the AI stack.

• nginx-ui 2.9.4 (this morning, 06:04 UTC) fixes include-pattern validation under an advisory ID, GHSA-8mrc, that isn't published yet. If you run nginx-ui, upgrade.
• FastMCP 4.1.5 (Sunday) lists one fix under Security with no advisory: provider-wrapped resource templates now keep their query-parameter list (#6130).

Paperwork your scanner may raise. LobeHub Chat's CVE-2026-120315 (8.8) is VulnCheck's identifier for GHSA-2g9j, covered on October 20: fixed in 2.1.49 in April.

Quiet elsewhere. GitHub's reviewed feed has published nothing since Friday 23:13 UTC; the same query for Wednesday and Thursday returns 117 records, so the zero is the weekend. The overnight unreviewed batches were mostly MediaTek's November bulletin, plus http4k and Parse Server, all outside both lists. MSRC hasn't revised anything since Sunday 02:46 UTC, and no .NET, ASP.NET Core or Azure record moved. Angular and PrimeNG released nothing.

Standing items. LMDeploy's PR 4964 is still open and 0.18.0 is still the newest release. fickling has both fixes on master and no release after v0.1.12. DeepInfer's PR 242 is still open. GitHub's record for oauthlib's GHSA-3jp2 still names 4.0.0; the fix is in 4.0.1. mcp-remote 0.16.0 shipped this morning and still declares open ^10.1.0. node-forge's two signature-forgery records still aren't in GitHub's database, and Open WebUI still hasn't published the advisories promised for 0.12.5. n8n's Databricks node, Agno, MLflow and Langflow are unchanged.