{"schema":"threatline.record/2","record":{"id":"CVE-2026-34157","aliases":["GHSA-47hv-j4px-h3c9"],"summary":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","details":"# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern\n\n| | |\n|---|---|\n| **Product** | wailsapp/wails (v2) |\n| **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` |\n| **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) |\n| **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` |\n| **CWE** | CWE-625: Permissive Regular Expression |\n| **Platforms** | Windows / Linux / macOS (all desktop targets) |\n\n---\n\n## Summary\n\nWails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.\n\nAn attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.\n\n---\n\n## Vulnerability Details\n\n### Root Cause\n\n`wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components.\n\n### Vulnerable Code\n\n**File:** `v2/internal/frontend/originvalidator/originValidator.go`\n\n```go\nfunc (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {\n    specialChars := []string{\"\\\\\", \".\", \"+\", \"?\", \"^\", \"$\", \"{\", \"}\", \"(\", \")\", \"|\", \"[\", \"]\"}\n\n    escaped := wildcardPattern\n    for _, specialChar := range specialChars {\n        escaped = strings.ReplaceAll(escaped, specialChar, \"\\\\\"+specialChar)\n    }\n\n    // * becomes .* — matches ANY character sequence, including dots and domain separators\n    escaped = strings.ReplaceAll(escaped, \"*\", \".*\")\n\n    return \"^\" + escaped + \"$\"\n}\n```\n\nThe generated regex for `https://myapp.com*` is:\n\n```\n^https://myapp\\.com.*$\n```\n\nThis matches any string beginning with `https://myapp.com`, including:\n\n- `https://myapp.community` — different TLD\n- `https://myapp.com.attacker.com` — attacker-controlled subdomain\n- `https://myapp.comXXXXX` — any arbitrary suffix\n\n### Scope Note\n\nThe official comment in `options.go` gives `https://*.myapp.com` as the example pattern (subdomain prefix wildcard). This pattern is **not affected**. The vulnerability only manifests when developers use a trailing wildcard (`myapp.com*`), which is a natural misuse when intending to permit a domain and all its subpaths or ports.\n\n---\n\n## Impact\n\nAny Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:\n\n- File system read / write (common in desktop apps)\n- Database queries\n- OS command execution (if exposed via bindings)\n- Sensitive configuration or credential access\n\n---\n\n## Fix\n\n**PR:** https://github.com/wailsapp/wails/pull/5074\n\nWildcards are now only expanded when they represent a full domain component (immediately after `://`, `.`, or `:`). A wildcard appended to a partial label (e.g. `com*`) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|---|---|\n| 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 |\n| 2026-03-26 | Private report submitted via GitHub Security Advisory |\n| 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) |\n| TBD | Patch release |\n| TBD + 90 days | Public disclosure deadline |","categories":["Libraries & packages"],"product":"github.com/wailsapp/wails/v2","vendor":"","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-47hv-j4px-h3c9","source_modified_at":"2026-10-27T13:29:48Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"go","name":"github.com/wailsapp/wails/v2"},"range":">= 2.0.0, < 2.13.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-47hv-j4px-h3c9","source_modified_at":"2026-10-27T13:45:03.096294624Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"github.com/wailsapp/wails/v2","ecosystem":"Go","purl":"pkg:golang/github.com/wailsapp/wails/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.13.0"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-47hv-j4px-h3c9","source_modified_at":"2026-10-27T13:29:48Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"go","name":"github.com/wailsapp/wails/v2"},"version":"2.13.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-47hv-j4px-h3c9","source_modified_at":"2026-10-27T13:45:03.096294624Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"github.com/wailsapp/wails/v2","ecosystem":"Go","purl":"pkg:golang/github.com/wailsapp/wails/v2"},"version":"2.13.0"}],"cvss":7.6,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T13:29:47Z","modified_at":"2026-10-27T13:45:03.096294624Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-47hv-j4px-h3c9","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:29:48Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-47hv-j4px-h3c9","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:45:03.096294624Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9","source":"GitHub Advisory Database"},{"url":"https://github.com/wailsapp/wails/pull/5074","source":"GitHub Advisory Database"},{"url":"https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-47hv-j4px-h3c9","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T13:45:03.096294624Z","content_hash":"79f807befd89ac56a4554b22900da82cae038d54108ca164788bb3d4cd550b88"}}