https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 07:15:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-34157 <p>Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application&#39;s bound methods. This issue is fixed in version 2.13.0.</p> <p>Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application&#39;s bound methods. This issue is fixed in version 2.13.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-34157 https://db.gcve.eu/vuln/ghsa-47hv-j4px-h3c9 <p><strong>Affected:</strong> Go: github.com/wailsapp/wails/v2</p> <p># Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern</p> <p>| | | |---|---| | **Product** | wailsapp/wails (v2) | | **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` | | **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) | | **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` | | **CWE** | CWE-625: Permissive Regular Expression | | **Platforms** | Windows / Linux / macOS (all desktop targets) |</p> <p>---</p> <p>## Summary</p> <p>Wails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.</p> <p>An attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application&#39;s exposed API surface.</p> <p>---</p> <p>## Vulnerability Details</p> <p>### Root Cause</p> <p>`wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components.</p> <p>### Vulnerable Code</p> <p>**File:** `v2/internal/…</p> <p><strong>Affected:</strong> Go: github.com/wailsapp/wails/v2</p> <p># Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern</p> <p>| | | |---|---| | **Product** | wailsapp/wails (v2) | | **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` | | **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) | | **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` | | **CWE** | CWE-625: Permissive Regular Expression | | **Platforms** | Windows / Linux / macOS (all desktop targets) |</p> <p>---</p> <p>## Summary</p> <p>Wails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.</p> <p>An attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application&#39;s exposed API surface.</p> <p>---</p> <p>## Vulnerability Details</p> <p>### Root Cause</p> <p>`wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components.</p> <p>### Vulnerable Code</p> <p>**File:** `v2/internal/…</p> https://db.gcve.eu/vuln/ghsa-47hv-j4px-h3c9