CVE-2026-34157

Wails v2 provides "BindingsAllowedOrigins" to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in "wildcardPatternToRegex" converts "" to "." without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction. An attacker who...

GHSA-47HV-J4PX-H3C9 Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...

PT-2026-127188

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails v2 | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator latest as of 2026-03-26 ...