{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awailswails/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wails:wails:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-34157"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["wails (\u003c 2.13.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","vulnerability","ipc","origin-bypass"],"_cs_type":"advisory","_cs_vendors":["Wails"],"content_html":"\u003cp\u003eWails v2 contains a vulnerability in the \u003ccode\u003ewildcardPatternToRegex\u003c/code\u003e function within \u003ccode\u003eoriginValidator.go\u003c/code\u003e. The implementation incorrectly replaces wildcards (\u003ccode\u003e*\u003c/code\u003e) with unanchored regex matchers (\u003ccode\u003e.*\u003c/code\u003e). Developers using a trailing wildcard pattern (e.g., \u003ccode\u003emyapp.com*\u003c/code\u003e) in \u003ccode\u003eBindingsAllowedOrigins\u003c/code\u003e inadvertently create a bypass, as the regex fails to restrict matches to legitimate domain boundaries. An attacker can craft a malicious origin (e.g., \u003ccode\u003emyapp.com.attacker.com\u003c/code\u003e or \u003ccode\u003emyapp.community\u003c/code\u003e) to invoke bound Go methods, leading to unauthorized actions such as file system access or command execution. The issue is addressed in PR #5074, which restricts wildcard expansion to full domain components.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eIf a Wails application exposes sensitive bindings, an attacker-controlled origin can execute those methods. Observed potential impacts include unauthorized file system read/write, credential exfiltration, and execution of OS commands if mapped to the application frontend.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Wails to version 2.13.0 or later once released.\u003c/li\u003e\n\u003cli\u003eAudit existing \u003ccode\u003eBindingsAllowedOrigins\u003c/code\u003e configurations in Wails applications. Ensure wildcard patterns are used only for full domain components (e.g., \u003ccode\u003ehttps://*.myapp.com\u003c/code\u003e) and avoid trailing wildcards on partial labels (e.g., \u003ccode\u003emyapp.com*\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eReview exposed Go methods in application bindings to ensure they follow the principle of least privilege.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T06:02:25Z","date_published":"2026-10-28T06:02:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wails-origin-bypass/","summary":"Wails v2 allows attackers to bypass BindingsAllowedOrigins restrictions via a permissive regex flaw in origin validation, potentially enabling unauthorized execution of Go backend methods.","title":"Wails: Origin validator bypass via wildcard pattern (CVE-2026-34157)","url":"https://feed.craftedsignal.io/briefs/2026-10-wails-origin-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wails:wails:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}