CVE-2026-34157

Name of the Vulnerable Software and Affected Versions Wails versions 2.0.0 through 2.13.0

Description An issue exists in the origin validation mechanism where the wildcardPatternToRegex function in v2/internal/frontend/originvalidator/originValidator.go incorrectly expands asterisk characters into unrestricted regular-expression matches. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix. This allows an attacker to bypass origin restrictions and invoke bound Go methods through Inter-Process Communication (IPC). The impact depends on the operations exposed by the application's bound methods, potentially leading to unauthorized file system access, database queries, or OS command execution.

Recommendations Update Wails to version 2.13.0. As a temporary workaround, avoid using trailing or partial-label wildcards in the BindingsAllowedOrigins configuration.