PT-2026-127188

CVE-2026-34157

·

Publicado

2026-10-27

·

Atualizado

2026-10-27

Descrição por

CVSS 4.0
7.6
Alta
MétricasAV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

Productwailsapp/wails (v2)
Affected Filev2/internal/frontend/originvalidator/originValidator.go
Affected VersionsAll versions containing originValidator (latest as of 2026-03-26)
CVSSv4.07.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
CWECWE-625: Permissive Regular Expression
PlatformsWindows / Linux / macOS (all desktop targets)

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.
An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go
go
func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
  specialChars := []string{"", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

  escaped := wildcardPattern
  for , specialChar := range specialChars {
    escaped = strings.ReplaceAll(escaped, specialChar, ""+specialChar)
  }

  // * becomes .* — matches ANY character sequence, including dots and domain separators
  escaped = strings.ReplaceAll(escaped, "*", ".*")

  return "^" + escaped + "$"
}
The generated regex for https://myapp.com* is:
^https://myapp.com.*$
This matches any string beginning with https://myapp.com, including:
  • https://myapp.community — different TLD
  • https://myapp.com.attacker.com — attacker-controlled subdomain
  • https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:
  • File system read / write (common in desktop apps)
  • Database queries
  • OS command execution (if exposed via bindings)
  • Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074
Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

DateEvent
2026-03-26Vulnerability discovered during source code audit by @Saku0512
2026-03-26Private report submitted via GitHub Security Advisory
2026-03-26Vendor acknowledgement and fix PR opened (#5074)
TBDPatch release
TBD + 90 daysPublic disclosure deadline
Explorabilidade
Correção
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-625: Permissive Regular Expression
Identificadores relacionados
CVE-2026-34157
GHSA-47HV-J4PX-H3C9
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com