← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-r5j2-ghh9-2jqw: Linux WebKitGTK Script Message Bridge Uses Top-Level WebView URI Instead of Calling Frame Origin (wailsapp/wails)

[OFFICIALLY PUBLISHED BY VENDOR • PATCHED IN Wails v2.17.1]
Officially published by Wails maintainers (27,000+ ★) on 2026-11-01T09:32:51Z as GHSA-r5j2-ghh9-2jqw (state: published, High severity, CVSS v3.1 8.3 / CVSS v4.0 8.9) with official author/reporter credit to @ccsimplyspolit, and patched upstream in v2.17.1.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-r5j2-ghh9-2jqw",
  "repository": "wailsapp/wails",
  "package": "go:github.com/wailsapp/wails/v2",
  "vulnerable_version_range": "<= 2.17.0",
  "patched_versions": "2.17.1",
  "html_url": "https://github.com/wailsapp/wails/security/advisories/GHSA-r5j2-ghh9-2jqw",
  "state": "published",
  "published_at": "2026-11-01T09:32:51Z",
  "summary": "Linux WebKitGTK Script Message Bridge Uses Top-Level WebView URI Instead of Calling Frame Origin, Bypassing OriginValidator in Embedded Iframes",
  "severity": "high",
  "cvss_v3": {
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
    "score": 8.3,
    "severity": "HIGH"
  },
  "cvss_v4": {
    "vector_string": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
    "score": 8.9,
    "severity": "HIGH"
  },
  "status": "Officially Published by Vendor (GHSA-r5j2-ghh9-2jqw) • Patched in v2.17.1",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-284",
    "CWE-346"
  ],
  "vulnerable_functions": [
    "windowMessageBridge",
    "handleMessage"
  ]
}