Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wailsapp/wails

              master @ f606b7f
            

Fixes

CVEs

HIGH

Peak severity

31.3%

Coverage

Highlights

Command Injection: 4 prior fixes. Scrutinize any change in this area.

.github/workflows/automated-releases.yml: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Inadequate URL sanitization and direct execution paths in browser opening helpers (such as OpenURL) allow shell command or argument injection through crafted URLs containing dangerous schemes or shell metacharacters.

Auth Bypass: Weak wildcard matching in origin validation allowed arbitrary subdomains or malicious sites to bypass domain checks and execute remote procedure calls (RPC) on native backend APIs.

Command Injection: The setup wizard's dependency installer lacked strict execution allowlists, allowing attackers who control setup parameters to execute arbitrary commands on the developer's host machine.