CVE-2026-34157

Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.

Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

• https://myapp.community — different TLD
• https://myapp.com.attacker.com — attacker-controlled subdomain
• https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

• File system read / write (common in desktop apps)
• Database queries
• OS command execution (if exposed via bindings)
• Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.

Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

• https://myapp.community — different TLD
• https://myapp.com.attacker.com — attacker-controlled subdomain
• https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

• File system read / write (common in desktop apps)
• Database queries
• OS command execution (if exposed via bindings)
• Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails