---
id: "CVE-2026-34157"
kind: "vulnerability"
aliases: ["CVE-2026-34157", "GHSA-47hv-j4px-h3c9"]
title: "Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/wailsapp/wails/v2", "fixed": ["2.13.0"], "affected": ">= 2.0.0, < 2.13.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-625", "desktop-apps", "go", "linux", "macos", "package", "wails", "windows"]
not_affected_if: ["exact-origins", "no-bindings-allowed-origins", "subdomain-prefix-pattern"]
published_at: "2026-10-27T13:29:47+00:00"
first_seen_at: "2026-10-27T13:31:05+00:00"
updated_at: "2026-10-27T13:32:27+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-47hv-j4px-h3c9", "first_seen_at": "2026-10-27T13:31:05+00:00"}]
---

# Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

Wails v2 converts a trailing wildcard in BindingsAllowedOrigins into an unanchored regex, so an origin such as myapp.com.attacker.com or myapp.community passes the check. A page on such an origin can call any Go method bound to the app, which may expose file access, data or commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/wailsapp/wails/v2 affected >= 2.0.0, < 2.13.0 fixed 2.13.0

## How to check

- Search the app's Go code and config for `BindingsAllowedOrigins` and look for patterns ending in `*` without a dot-prefixed subdomain, such as `https://myapp.com*`.
- Check the Wails version with `go list -m github.com/wailsapp/wails/v2`; versions from `2.0.0` up to but not including `2.13.0` are affected.

## Fix

- Upgrade `github.com/wailsapp/wails/v2` to `2.13.0` or later (fix PR #5074).
- Until upgraded, replace trailing wildcards like `myapp.com*` with exact origins or `https://*.myapp.com` style subdomain patterns.

## Timeline

- 2026-10-27T13:31:05+00:00 ghsa https://github.com/advisories/GHSA-47hv-j4px-h3c9

## From the sources

# Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | |
|---|---|
| **Product** | wailsapp/wails (v2) |
| **Affected File** | `v2/internal/frontend/originvalidator/originValidator.go` |
| **Affected Versions** | All versions containing originValidator (latest as of 2026-03-26) |
| **CVSSv4.0** | **7.6 HIGH** — `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N` |
| **CWE** | CWE-625: Permissive Regular Expression |
| **Platforms** | Windows / Linux / macOS (all desktop targets) |

---

## Summary

Wails v2 provides `BindingsAllowedOrigins` to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in `wildcardPatternToRegex` converts `*` to `.*` without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., `myapp.community` when `myapp.com*` is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

---

## Vulnerability Details

### Root Cause

`wildcardPatternToRegex` converts a wildcard pattern to a regular expression by escaping special characters and replacing `*` with `.*`. The substituted `.*` has no restriction — it matches any character sequence including dots and additional domain components.

### Vulnerable Code

**File:** `v2/internal/frontend/originvalidator/originValidator.go`

```go
func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}
```

The generated regex for `https://myapp.com*` is:

```
^https://myapp\.com.*$
```

This matches any string beginning with `https://myapp.com`, including:

- `https://myapp.community` — different TLD
- `https://myapp.com.attacker.com` — attacker-controlled subdomain
- `https://myapp.comXXXXX` — any arbitrary suffix

### Scope Note

The official comment in `options.go` gives `https://*.myapp.com` as the example pattern (subdomain prefix wildcard). This pattern is **not affected**. The vulnerability only manifests when developers use a trailing wildcard (`myapp.com*`), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

---

## Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

- File system read / write (common in desktop apps)
- Database queries
- OS command execution (if exposed via bindings)
- Sensitive configuration or credential access

---

## Fix

**PR:** https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after `://`, `.`, or `:`). A wildcard appended to a partial label (e.g. `com*`) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

---

## Disclosure Timeline

| Date | Event |
|---|---|
| 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 |
| 2026-03-26 | Private report submitted via GitHub Security Advisory |
| 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) |
| TBD | Patch release |
| TBD + 90 days | Public disclosure deadline |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_