Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Why it is Yellow

• CVSS 7.6 high
• Remotely exploitable without logging in
• On your watchlist: Go

Affected packages

References

• https://github.com/advisories/GHSA-47hv-j4px-h3c9
• https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9
• https://github.com/wailsapp/wails/pull/5074
• https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81
• https://github.com/advisories/GHSA-47hv-j4px-h3c9

Original description

# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | **Product** | wailsapp/wails (v2) | | **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` | | **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) | | **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` | | **CWE** | CWE-625: Permissive Regular Expression | | **Platforms** | Windows / Linux / macOS (all desktop targets) | --- ## Summary Wails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction. An attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface. --- ## Vulnerability Details ### Root Cause `wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components. ### Vulnerable Code **File:** `v2/internal/frontend/originvalidator/originValidator.go` ```go func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string { specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"} escaped := wildcardPattern for _, specialChar := range specialChars { escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar) } // * becomes .* — matches ANY character sequence, including dots and domain separators escaped = strings.ReplaceAll(escaped, "*", ".*") return "^" + escaped + "$" } ``` The generated regex for `https://myapp.com*` is: ``` ^https://myapp\.com.*$ ``` This matches any string beginning with `https://myapp.com`, including: - `https://myapp.community` — different TLD - `https://myapp.com.attacker.com` — attacker-controlled subdomain - `https://myapp.comXXXXX` — any arbitrary suffix ### Scope Note The official comment in `options.go` gives `https://*.myapp.com` as the example pattern (subdomain prefix wildcard). This pattern is **not affected**. The vulnerability only manifests when developers use a trailing wildcard (`myapp.com*`), which is a natural misuse when intending to permit a domain and all its subpaths or ports. --- ## Impact Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application: - File system read / write (common in desktop apps) - Database queries - OS command execution (if exposed via bindings) - Sensitive configuration or credential access --- ## Fix **PR:** https://github.com/wailsapp/wails/pull/5074 Wildcards are now only expanded when they represent a full domain component (immediately after `://`, `.`, or `:`). A wildcard appended to a partial label (e.g. `com*`) is stripped, preventing suffix-based bypasses. Comprehensive test suite added. --- ## Disclosure Timeline | Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |