AI Security News: November 2, 2026

1. Prefab UI’s Generative UI Sandbox Let FastMCP Tool Callers Read and Write Server Files (CVSS 10.0)

Prefect’s Prefab UI has CVE-2026-120338 (GHSA-3g72-rrqc-f76c, CVSS 3.1 10.0 critical, assigned by JFrog and published November 1) in its Generative UI sandbox, which runs caller-supplied Python in Pyodide inside a Deno subprocess and is documented as isolation for untrusted code, including LLM-written UI. In prefab-ui 0.14.0 through 0.20.2 the launcher started Deno with unrestricted --allow-read, --allow-write and --allow-net and left the Deno API on the JavaScript global object, so Python could reach Deno.readTextFileSync and Deno.writeTextFileSync through Pyodide’s js module, read and write files as the server user, and persist code execution by dropping a .pth file into the server virtualenv’s site-packages. The usual remote path is FastMCP’s GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards its code argument into the sandbox: on a FastMCP server with no authentication any client that can reach it can call the tool, and with authentication any client allowed to call tools can. Generative UI is opt-in and needs Deno on the host; version 0.21.0, released October 26, revokes Deno read, write and network permissions before accepting code, starts the process with --no-prompt, and limits bootstrap network access to cdn.jsdelivr.net. Source

2. LobeHub File Names Could Overwrite the Server’s Startup Script for Code Execution

LobeHub, the open-source AI agent and chat platform, has CVE-2026-120315 (CVSS 3.1 8.8, CVSS 4.0 8.7 high, published November 2 by VulnCheck; project advisory GHSA-2g9j-v25c-4j97) affecting @lobehub/chat from 1.84.26 before 2.1.49 in server-database deployments. Any authenticated user could create a file record through the file.createFile tRPC procedure with a traversal name such as ../../app/startServer.js, then call document parsing, which downloads the file to a temporary directory by passing the stored name unsanitized to path.join() in writeTempFile(). The reporter, Sn1r, showed this overwriting the container’s startup script so that attacker JavaScript runs on the next restart, and notes the same primitive can corrupt application files into a crash loop or overwrite configuration. The fix is in 2.1.49; the project published its advisory on October 17, and the CVE followed on November 2. Source

3. MCPHub Forwarded Callers’ Session Tokens to Any OpenAPI Server a Regular User Registered

MCPHub, a self-hosted gateway and control plane for MCP servers, fixed CVE-2026-120323 (GHSA-c48q-fjwh-j7gg, published November 2; VulDB scores it CVSS 3.1 4.3 and CVSS 4.0 5.3 medium, while the researcher rates it 7.3) in 1.1.8. Through 1.0.45 and 1.1.7, a non-admin user could register an OpenAPI-type MCP server whose openapi.url points at an attacker endpoint and whose passthroughHeaders list names Authorization, Cookie and X-Api-Key, because that configuration was not classed as privileged. When any other user, including an administrator, called a tool on that server, MCPHub copied those headers verbatim from the caller’s own authenticated request into the outbound call, handing the attacker the admin’s bearer key or session cookie; the write-up notes that an admin key then allows rewriting global settings and, through admin-installed stdio servers, command execution on the hub host. The patch (commit 040f7b9, merged October 20) changes header passthrough handling and server configuration validation, and the researcher recommends a denylist for authentication headers and admin-only control of passthrough settings. Source

4. Network-AI’s A2A Server Failed Open Without a Secret, and Path Traversals Could Forge Its Agent Authorization Policy

Network-AI, a TypeScript multi-agent orchestrator on npm with guardrails and adapters for other agent frameworks, received four CVEs from VulnCheck on November 2, all fixed in 5.15.5. CVE-2026-120314 (CVSS 3.1 7.3) covers the A2AServer class, which applied Bearer authentication only when an optional secret was set and started without one by default, so any client that could reach it could submit task text to the developer’s executor via tasks/send, read results and cancel tasks; it binds to 127.0.0.1 by default, and the package’s MCP servers already refused to start without a secret. CVE-2026-120311 and CVE-2026-120312 (both CVSS 3.1 8.8) are path traversals in FileJobStore job IDs and AgentVCR cassette names that read, write or delete arbitrary .json files; the reporter showed that deleting or overwriting the trust-level configuration made the AuthGuardian component grant permissions to an agent the operator had placed below the denial threshold, and that persisted grant tokens read this way validated on replay. CVE-2026-120313 (CVSS 4.0 8.7) is an unanchored startsWith check in InputSanitizer.sanitizePath() that accepts sibling directories sharing the base path’s prefix. The project published its advisories on October 17. A2AServer AgentVCR

5. AG-UI’s TypeScript Client Follows Redirects With Tenant Headers, With the Fix Still Unmerged

AG-UI, the Agent-User Interaction protocol, has CVE-2026-120233 (GHSA-mm62-6q8x-jm5m, CVSS 3.1 5.3, CVSS 4.0 5.5 medium, published November 1) in HttpAgent from @ag-ui/client through 0.0.58. The client builds its fetch request without a redirect option, so a malicious or compromised agent endpoint can answer the run POST with a redirect to an origin it chooses; in the reporter’s Node test the re-sent request carried the run envelope (threadId, runId) and developer-supplied headers such as tenant IDs and API keys, though Authorization was stripped cross-origin, and under the Fetch specification browsers also keep the full body, including conversation history and tool schemas, across 307 and 308 redirects. The issue was filed August 25, the reporter recommends pinning redirect: "manual" or "error", and the fix pull request had not been merged when the CVE was published. Separately, VulDB published two low-severity path traversals (CVE-2026-120334, CVSS 3.1 4.3, and CVE-2026-120335, CVSS 3.1 4.8) on November 2 in the tokenizer and word-embedding loaders of deepset’s FARM through 0.8.0, a transfer-learning library that is no longer supported; the advisories say deepset did not respond to the reporter. AG-UI FARM