Threats tagged 'ghsa-47hv-j4px-h3c9'

Wails v2 contains a vulnerability in its origin validation logic where wildcard patterns in BindingsAllowedOrigins are improperly converted to regular expressions. This allows origins with suffixes matching the allowed pattern to bypass restrictions and invoke Go backend methods. The issue affects versions before 2.13.0 and can lead to unauthorized access to file systems, databases, or command execution depending on the exposed API surface. A fix is available in version 2.13.0.