GHSA-47hv-j4px-h3c9: Go/github.com/wailsapp/wails/v2 vulnerability

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

---

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts to . without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

---

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing with .. The substituted . has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

go func (v OriginValidator) wildcardPatternToRegex(wildcardPattern string) string { specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

escaped := wildcardPattern for , specialChar := range specialChars { escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar) }

// becomes . — matches ANY character sequence, including dots and domain separators escaped = strings.ReplaceAll(escaped, "", ".")

return "^" + escaped + "$" }

The generated regex for https://myapp.com is:

^https://myapp\.com.$

This matches any string beginning with https://myapp.com, including:

- https://myapp.community — different TLD - https://myapp.com.attacker.com — attacker-controlled subdomain - https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

---

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

- File system read / write (common in desktop apps) - Database queries - OS command execution (if exposed via bindings) - Sensitive configuration or credential access

---

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

---

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |