{"id":"GHSA-47hv-j4px-h3c9","revision":null,"records":[{"revision":"6fd0ede2b54140d6a43f4c61a0704527","observedAt":"2026-10-27T14:13:02.28+00:00","statement":{"source":"osv","id":"GHSA-47hv-j4px-h3c9","aliases":["CVE-2026-34157"],"title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","description":"# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern\n\n| | |\n|---|---|\n| **Product** | wailsapp/wails (v2) |\n| **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` |\n| **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) |\n| **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` |\n| **CWE** | CWE-625: Permissive Regular Expression |\n| **Platforms** | Windows / Linux / macOS (all desktop targets) |\n\n---\n\n## Summary\n\nWails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.\n\nAn attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.\n\n---\n\n## Vulnerability Details\n\n### Root Cause\n\n`wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components.\n\n### Vulnerable Code\n\n**File:** `v2/internal/frontend/originvalidator/originValidator.go`\n\n```go\nfunc (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {\n    specialChars := []string{\"\\\\\", \".\", \"+\", \"?\", \"^\", \"$\", \"{\", \"}\", \"(\", \")\", \"|\", \"[\", \"]\"}\n\n    escaped := wildcardPattern\n    for _, specialChar := range specialChars {\n        escaped = strings.ReplaceAll(escaped, specialChar, \"\\\\\"+specialChar)\n    }\n\n    // * becomes .* — matches ANY character sequence, including dots and domain separators\n    escaped = strings.ReplaceAll(escaped, \"*\", \".*\")\n\n    return \"^\" + escaped + \"$\"\n}\n```\n\nThe generated regex for `https://myapp.com*` is:\n\n```\n^https://myapp\\.com.*$\n```\n\nThis matches any string beginning with `https://myapp.com`, including:\n\n- `https://myapp.community` — different TLD\n- `https://myapp.com.attacker.com` — attacker-controlled subdomain\n- `https://myapp.comXXXXX` — any arbitrary suffix\n\n### Scope Note\n\nThe official comment in `options.go` gives `https://*.myapp.com` as the example pattern (subdomain prefix wildcard). This pattern is **not affected**. The vulnerability only manifests when developers use a trailing wildcard (`myapp.com*`), which is a natural misuse when intending to permit a domain and all its subpaths or ports.\n\n---\n\n## Impact\n\nAny Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:\n\n- File system read / write (common in desktop apps)\n- Database queries\n- OS command execution (if exposed via bindings)\n- Sensitive configuration or credential access\n\n---\n\n## Fix\n\n**PR:** https://github.com/wailsapp/wails/pull/5074\n\nWildcards are now only expanded when they represent a full domain component (immediately after `://`, `.`, or `:`). A wildcard appended to a partial label (e.g. `com*`) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|---|---|\n| 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 |\n| 2026-03-26 | Private report submitted via GitHub Security Advisory |\n| 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) |\n| TBD | Patch release |\n| TBD + 90 days | Public disclosure deadline |","state":0,"publishedAt":"2026-10-27T13:29:47+00:00","modifiedAt":"2026-10-27T13:45:03.0962946+00:00","affected":[{"ecosystem":"Go","name":"github.com/wailsapp/wails/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9","https://github.com/wailsapp/wails/pull/5074","https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81","https://github.com/wailsapp/wails"],"sourceUrl":"https://github.com/advisories/GHSA-47hv-j4px-h3c9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-47hv-j4px-h3c9","identifiers":["GHSA-47hv-j4px-h3c9","CVE-2026-34157"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T16:47:08.0799506+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T16:47:08.0799506+00:00","lastSuccessAt":"2026-10-30T16:47:08.2603913+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.2603923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-d7b222ecfb3b37ed75e1512e40fdcf28594abff2a8568f1274ffe87891d61caa","complete":true,"records":417228,"lastAttemptAt":"2026-10-30T16:45:32.5536592+00:00","lastSuccessAt":"2026-10-30T16:45:32.4100997+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:45:32.5536592+00:00","snapshotPublishedAt":"2026-10-30T16:25:31+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d108ae5c471c41b994c834e71d661fb6","complete":false,"records":13527,"lastAttemptAt":"2026-10-30T16:52:32.031615+00:00","lastSuccessAt":"2026-10-30T16:52:32.1272839+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:52:32.1272839+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T16:47:08.0799506+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T16:47:08.0799506+00:00","lastSuccessAt":"2026-10-30T16:47:08.2616584+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.2616589+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0f2f428ccf42491d9927e55626b8fc62","complete":false,"records":13545,"lastAttemptAt":"2026-10-30T16:47:33.5927086+00:00","lastSuccessAt":"2026-10-30T16:47:33.589+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:33.589+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13603,"expectedIdentifiers":13605,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-e091d9104aae1991994c868b5fad0248c9b288abafb7672fca8ae6500f97e080","complete":true,"records":9808,"lastAttemptAt":"2026-10-30T16:47:08.0351821+00:00","lastSuccessAt":"2026-10-30T15:47:48.5635219+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.0351821+00:00","snapshotPublishedAt":"2026-10-30T15:23:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T16:45:32.7049631+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:45:32.7049631+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f63fa91e750071ae88c9f82019ecd6c982fa4fcc1d3dc5ceb5d9c642fb6bf05c","complete":true,"records":3023,"lastAttemptAt":"2026-10-30T16:47:08.0492653+00:00","lastSuccessAt":"2026-10-30T11:49:36.4759887+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.0492653+00:00","snapshotPublishedAt":"2026-10-30T11:18:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5a294989873fb9168d8ae38882a7a1451dd62315f67b71899ceec86dfb29d13b","complete":true,"records":230954,"lastAttemptAt":"2026-10-30T16:47:07.9043788+00:00","lastSuccessAt":"2026-10-30T16:47:06.5719002+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:07.9043788+00:00","snapshotPublishedAt":"2026-10-30T16:33:30+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}