Summary
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Security Vulnerability Report: Wails v2, Origin Validator Bypass via Wildcard Pattern
| Product | wailsapp/wails (v2) |
| Affected File | v2/internal/frontend/originvalidator/originValidator.go |
| Affected Versions | All versions containing originValidator (latest as of 2026-03-26) |
| CVSSv4.0 | 7.6 HIGH, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N |
| CWE | CWE-625: Permissive Regular Expression |
| Platforms | Windows / Linux / macOS (all desktop targets) |
Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.
An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.
Vulnerability Details
Root Cause
wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction, it matches any character sequence including dots and additional domain components.
Vulnerable Code
File: v2/internal/frontend/originvalidator/originValidator.go
func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}
escaped := wildcardPattern
for _, specialChar := range specialChars {
escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
}
// * becomes .*, matches ANY character sequence, including dots and domain separators
escaped = strings.ReplaceAll(escaped, "*", ".*")
return "^" + escaped + "$"
}
The generated regex for https://myapp.com* is:
^https://myapp\.com.*$
This matches any string beginning with https://myapp.com, including:
https://myapp.community, different TLDhttps://myapp.com.attacker.com, attacker-controlled subdomainhttps://myapp.comXXXXX, any arbitrary suffix
Scope Note
The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.
Disclosure Timeline
| Date | Event |
|---|---|
| 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 |
| 2026-03-26 | Private report submitted via GitHub Security Advisory |
| 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) |
| TBD | Patch release |
| TBD + 90 days | Public disclosure deadline |
Impact
Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:
- File system read / write (common in desktop apps)
- Database queries
- OS command execution (if exposed via bindings)
- Sensitive configuration or credential access
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
PR: https://github.com/wailsapp/wails/pull/5074
Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.
Frequently Asked Questions
- What is CVE-2026-34157? CVE-2026-34157 is a high-severity security vulnerability in github.com/wailsapp/wails/v2 (go), affecting versions >= 2.0.0, < 2.13.0. It is fixed in 2.13.0.
- Which versions of github.com/wailsapp/wails/v2 are affected by CVE-2026-34157? github.com/wailsapp/wails/v2 (go) versions >= 2.0.0, < 2.13.0 is affected.
- Is there a fix for CVE-2026-34157? Yes. CVE-2026-34157 is fixed in 2.13.0. Upgrade to this version or later.
- Is CVE-2026-34157 exploitable, and should I be worried? Whether CVE-2026-34157 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-34157 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-34157? Upgrade
github.com/wailsapp/wails/v2to 2.13.0 or later.