CVE-2026-34157

Wails v2 provides "BindingsAllowedOrigins" to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in "wildcardPatternToRegex" converts "" to "." without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction. An attacker who...