{"id":"CVE-2026-34157","aliases":["EUVD-2026-117787","GHSA-47hv-j4px-h3c9","GO-2026-6862"],"status":"published","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","description":"Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.","severity":{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00499,"percentile":0.43068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-625"],"published":"2026-10-27T13:29:47Z","modified":"2026-11-06T10:47:35Z","exploits":[{"source":"pocgithub","id":"Saku0512/CVE-2026-34157-poc","title":"Saku0512/CVE-2026-34157-poc","date":"2026-10-18","url":"https://github.com/Saku0512/CVE-2026-34157-poc"}],"fixes":[{"ecosystem":"Go","package":"github.com/wailsapp/wails/v2","fixed_in":["2.13.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/wailsapp/wails/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.13.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/wailsapp/wails/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.13.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/wailsapp/wails/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.13.0"}]}]}],"products":[{"vendor":"wailsapp","product":"wails"}],"references":[{"url":"https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/wailsapp/wails/pull/5074","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/wailsapp/wails/releases/tag/v2.13.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-47hv-j4px-h3c9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34157.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34157","tags":["advisory"]},{"url":"https://github.com/wailsapp/wails","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34157","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","description":"Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.","status":"published","published":"2026-11-05T20:26:04.218Z","modified":"2026-11-09T18:28:05.289Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-625"],"updated_at":"2026-11-09T19:34:29.555364Z"}],"euvd":[{"id":"EUVD-2026-117787","description":"Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.","status":"published","published":"2026-11-05T20:26:04Z","modified":"2026-11-09T18:28:05Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","level":"high"}],"updated_at":"2026-11-09T19:17:50.030863Z"}],"ghsa":[{"id":"GHSA-47hv-j4px-h3c9","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","description":"# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern\n\n| | |\n|---|---|\n| **Product** | wailsapp/wails (v2) |\n| **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` |\n| **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) |\n| **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` |\n| **CWE** | CWE-625: Permissive Regular Expression |\n| **Platforms** | Windows / Linux / macOS (all desktop targets) |\n\n---\n\n## Summary\n\nWails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.\n\nAn attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.\n\n---\n\n## Vulnerability Details\n\n### Root Cause\n\n`wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components.\n\n### Vulnerable Code\n\n**File:** `v2/internal/frontend/originvalidator/originValidator.go`\n\n```go\nfunc (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {\n    specialChars := []string{\"\\\\\", \".\", \"+\", \"?\", \"^\", \"$\", \"{\", \"}\", \"(\", \")\", \"|\", \"[\", \"]\"}\n\n    escaped := wildcardPattern\n    for _, specialChar := range specialChars {\n        escaped = strings.ReplaceAll(escaped, specialChar, \"\\\\\"+specialChar)\n    }\n\n    // * becomes .* — matches ANY character sequence, including dots and domain separators\n    escaped = strings.ReplaceAll(escaped, \"*\", \".*\")\n\n    return \"^\" + escaped + \"$\"\n}\n```\n\nThe generated regex for `https://myapp.com*` is:\n\n```\n^https://myapp\\.com.*$\n```\n\nThis matches any string beginning with `https://myapp.com`, including:\n\n- `https://myapp.community` — different TLD\n- `https://myapp.com.attacker.com` — attacker-controlled subdomain\n- `https://myapp.comXXXXX` — any arbitrary suffix\n\n### Scope Note\n\nThe official comment in `options.go` gives `https://*.myapp.com` as the example pattern (subdomain prefix wildcard). This pattern is **not affected**. The vulnerability only manifests when developers use a trailing wildcard (`myapp.com*`), which is a natural misuse when intending to permit a domain and all its subpaths or ports.\n\n---\n\n## Impact\n\nAny Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:\n\n- File system read / write (common in desktop apps)\n- Database queries\n- OS command execution (if exposed via bindings)\n- Sensitive configuration or credential access\n\n---\n\n## Fix\n\n**PR:** https://github.com/wailsapp/wails/pull/5074\n\nWildcards are now only expanded when they represent a full domain component (immediately after `://`, `.`, or `:`). A wildcard appended to a partial label (e.g. `com*`) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|---|---|\n| 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 |\n| 2026-03-26 | Private report submitted via GitHub Security Advisory |\n| 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) |\n| TBD | Patch release |\n| TBD + 90 days | Public disclosure deadline |","status":"published","published":"2026-10-27T13:29:47Z","modified":"2026-10-27T13:29:48Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","level":"high"}],"cwes":["CWE-625"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-34157","description":"Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.","status":"published","published":"2026-11-05T21:18:47.3Z","modified":"2026-11-09T19:17:04.85Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-625"],"updated_at":"2026-11-09T22:15:54.636427Z"}],"osv":[{"id":"CVE-2026-34157","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","description":"Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.","status":"published","published":"2026-11-05T20:26:04.218Z","modified":"2026-11-07T02:48:28.313203341Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","level":"high"}],"cwes":["CWE-625"],"updated_at":"2026-11-07T03:08:04.213635Z"},{"id":"GHSA-47hv-j4px-h3c9","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","description":"# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern\n\n| | |\n|---|---|\n| **Product** | wailsapp/wails (v2) |\n| **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` |\n| **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) |\n| **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` |\n| **CWE** | CWE-625: Permissive Regular Expression |\n| **Platforms** | Windows / Linux / macOS (all desktop targets) |\n\n---\n\n## Summary\n\nWails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.\n\nAn attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.\n\n---\n\n## Vulnerability Details\n\n### Root Cause\n\n`wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components.\n\n### Vulnerable Code\n\n**File:** `v2/internal/frontend/originvalidator/originValidator.go`\n\n```go\nfunc (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {\n    specialChars := []string{\"\\\\\", \".\", \"+\", \"?\", \"^\", \"$\", \"{\", \"}\", \"(\", \")\", \"|\", \"[\", \"]\"}\n\n    escaped := wildcardPattern\n    for _, specialChar := range specialChars {\n        escaped = strings.ReplaceAll(escaped, specialChar, \"\\\\\"+specialChar)\n    }\n\n    // * becomes .* — matches ANY character sequence, including dots and domain separators\n    escaped = strings.ReplaceAll(escaped, \"*\", \".*\")\n\n    return \"^\" + escaped + \"$\"\n}\n```\n\nThe generated regex for `https://myapp.com*` is:\n\n```\n^https://myapp\\.com.*$\n```\n\nThis matches any string beginning with `https://myapp.com`, including:\n\n- `https://myapp.community` — different TLD\n- `https://myapp.com.attacker.com` — attacker-controlled subdomain\n- `https://myapp.comXXXXX` — any arbitrary suffix\n\n### Scope Note\n\nThe official comment in `options.go` gives `https://*.myapp.com` as the example pattern (subdomain prefix wildcard). This pattern is **not affected**. The vulnerability only manifests when developers use a trailing wildcard (`myapp.com*`), which is a natural misuse when intending to permit a domain and all its subpaths or ports.\n\n---\n\n## Impact\n\nAny Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:\n\n- File system read / write (common in desktop apps)\n- Database queries\n- OS command execution (if exposed via bindings)\n- Sensitive configuration or credential access\n\n---\n\n## Fix\n\n**PR:** https://github.com/wailsapp/wails/pull/5074\n\nWildcards are now only expanded when they represent a full domain component (immediately after `://`, `.`, or `:`). A wildcard appended to a partial label (e.g. `com*`) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|---|---|\n| 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 |\n| 2026-03-26 | Private report submitted via GitHub Security Advisory |\n| 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) |\n| TBD | Patch release |\n| TBD + 90 days | Public disclosure deadline |","status":"published","published":"2026-10-27T13:29:47Z","modified":"2026-11-05T23:25:53.04250038Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N","level":"high"}],"cwes":["CWE-625"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"GO-2026-6862","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails","description":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails","status":"published","published":"2026-11-05T22:54:32Z","modified":"2026-11-05T23:15:14.506576848Z","updated_at":"2026-11-06T00:02:13.631839Z"}]}}