Vulnerabilities

Security research · CVE-2026-34157

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Published Oct 27, 2026 · catalog updated Oct 27, 2026 · Wails: wildcardPatternToRegex allows Origin

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-34157. A missing EPSS score is not a low risk. Compare Wails: wildcardPatternToRegex allows Origin with the linked advisory before you change production.

Severity

High—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Not in the current FIRST EPSS dataset

Remediation

Advisory link

Affected products

Go github.com/wailsapp/wails/v2

# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | **Product** | wailsapp/wails (v2) | | **Affected File** | | | **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) | | **CVSSv4.0** | **7.6 HIGH** — | | **CWE** | CWE-625: Permissive Regular Expression | | **Platforms** | Windows / Linux / macOS (all desktop targets) | --- ## Summary Wails v2 provides to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in converts to without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction. An attacker who controls a domain sharing a prefix with the allowed origin (e.g., when is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface. --- ## Vulnerability Details ### Root Cause converts a wildcard pattern to a regular expression by escaping special characters and replacing with . The substituted has no restriction — it matches any character sequence including dots and additional domain components. ### Vulnerable Code **File:** The generated regex for is: This matches any string beginning with , including: - — different TLD - — attacker-controlled subdomain - — any arbitrary suffix ### Scope Note The official comment in gives as the example pattern (subdomain prefix wildcard). This pattern is **not affected**. The vulnerability only manifests when developers use a trailing wildcard ( ), which is a natural misuse when intending to permit a domain and all its subpaths or ports. --- ## Impact Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application: - File system read / write (common in desktop apps) - Database queries - OS command execution (if exposed via bindings) - Sensitive configuration or credential access --- ## Fix **PR:**