HIGH GitHub
CVE-2026-34157
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern
| | |
|---|---|
| **Product** | wailsapp/wails (v2) |
| **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` |
| **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) |
| **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` |
| **CWE** | CWE-625: Permissive Regular Expression |
| **Platforms** | Windows /
Affected Products
- go/github.com/wailsapp/wails/v2 >= 2.0.0, < 2.13.0
References
- https://github.com/advisories/GHSA-47hv-j4px-h3c9
- https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9
- https://github.com/wailsapp/wails/pull/5074
- https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81
This high severity vulnerability was published on 2026-10-27 via GitHub. Affected: go/github.com/wailsapp/wails/v2 >= 2.0.0, < 2.13.0.
vulnfeed aggregates 18707 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.