AIKIDO-2026-292414

TL;DR

Before the fix, PyodideSandbox started the Generative UI sandbox's Deno runner with unrestricted --allow-read, --allow-write and --allow-net, and the runner executed caller-supplied Python without revoking those permissions, so the code reached host file read and write through Pyodide's js module and could persist execution by writing a .pth file into site-packages. Anyone allowed to invoke the sandbox, locally or through FastMCP's generate_prefab_ui tool on a server with no authentication, could supply the code; the feature is opt-in and needs Deno installed on the host. Versions 0.14.0 through 0.20.2 are affected. The fix restricts Deno's network to the Pyodide CDN, adds --no-prompt, and revokes read, write and net permissions before any generated code runs.