CVE-2026-34157 json
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
published 2026-10-27 12 d ago modified 2026-11-05 3 d ago also GHSA-47hv-j4px-h3c9 , GO-2026-6862 , EUVD-2026-117787
- cvss
- 7.6
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.
Patch / fix
- go github.com/wailsapp/wails/v2 2.13.0
- github.com/wailsapp/wails@bcc5941 commit
- github.com/wailsapp/wails#5074 pull request
- github.com/wailsapp/wails/releases/tag/v2.13.0 release
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N |
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/wailsapp/wails/v2 | >=2.0.0, <2.13.0 |
2.13.0 |
Affected products
- wailsapp wails
Classification
- Weakness
-
- CWE-625 Permissive Regular Expression
References
Sources
- CVE List CVE-2026-34157
- GitHub Advisory GHSA-47hv-j4px-h3c9
- NVD CVE-2026-34157
- OSV GO-2026-6862
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.