Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-34157Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High 7.6

In plain English

A high-severity security flaw in wails from wailsapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.6High
Exploit odds (30 days)0.5%top 57.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/wailsapp/wails/v22.13.0GHSA-47hv-j4px-h3c9
Gogithub.com/wailsapp/wails/v22.13.0GO-2026-6862

Affected products (as reported)

VendorProductVersions
wailsapp wails >= 2.0.0, < 2.13.0

Weakness: CWE-625 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

References