PrefectHQ vulnerabilities
We track 8 vulnerabilities in PrefectHQ products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on November 1, 2026.
Latest PrefectHQ vulnerabilities
- 10.0 Critical severity
prefab-ui: Improper Control of Generation of Code
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the la
- 8.8 High severity
Prefect: Improper Neutralization of Argument Delimiters in a Command
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling inje
- 9.9 Critical severity
prefecthq/prefect: Improper Control of Generation of Code
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` sepa
- 7.5 High severity
prefecthq/prefect: Incorrect Authorization
In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready'
- 8.5 High severity
prefecthq/prefect: Improper Neutralization of Argument Delimiters in a Command
A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly into a `git
- 7.3 High severity
prefect: Improper Authentication
A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The e
- 10.0 Critical severity
fastmcp: Server-Side Request Forgery
FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests t
- 7.6 High severity
prefecthq/prefect: Origin Validation Error
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of con