Cpe:2.3:a:wails:wails:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awailswails/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 06:02:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWails: Origin validator bypass via wildcard pattern (CVE-2026-34157)https://feed.craftedsignal.io/briefs/2026-10-wails-origin-bypass/Wed, 28 Oct 2026 06:02:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wails-origin-bypass/Wails v2 allows attackers to bypass BindingsAllowedOrigins restrictions via a permissive regex flaw in origin validation, potentially enabling unauthorized execution of Go backend methods.Wails v2 contains a vulnerability in the wildcardPatternToRegex function within originValidator.go. The implementation incorrectly replaces wildcards (*) with unanchored regex matchers (.*). Developers using a trailing wildcard pattern (e.g., myapp.com*) in BindingsAllowedOrigins inadvertently create a bypass, as the regex fails to restrict matches to legitimate domain boundaries. An attacker can craft a malicious origin (e.g., myapp.com.attacker.com or myapp.community) to invoke bound Go methods, leading to unauthorized actions such as file system access or command execution. The issue is addressed in PR #5074, which restricts wildcard expansion to full domain components.

Impact

If a Wails application exposes sensitive bindings, an attacker-controlled origin can execute those methods. Observed potential impacts include unauthorized file system read/write, credential exfiltration, and execution of OS commands if mapped to the application frontend.

Recommendation

  • Upgrade Wails to version 2.13.0 or later once released.
  • Audit existing BindingsAllowedOrigins configurations in Wails applications. Ensure wildcard patterns are used only for full domain components (e.g., https://*.myapp.com) and avoid trailing wildcards on partial labels (e.g., myapp.com*).
  • Review exposed Go methods in application bindings to ensure they follow the principle of least privilege.
]]>highadvisoryweb-applicationvulnerabilityipcorigin-bypass