Version	Released
`v2.17.0` minor	Oct 18, 2026
`v2.16.0` minor	Sep 14, 2026
`v2.15.0` minor	Aug 17, 2026
`v2.14.0` minor	Aug 10, 2026
`v2.13.0` minor	Jul 06, 2026
`v2.12.0` minor 1 CVE	Mar 26, 2026
`v2.11.0` minor 1 CVE	Nov 08, 2025
`v2.10.2` patch 1 CVE	Jul 06, 2025
`v2.10.1` patch 1 CVE	Feb 24, 2025
`v2.10.0` minor 1 CVE	Feb 14, 2025
`v2.9.3` patch 1 CVE	Feb 12, 2025
`v2.9.2` patch 1 CVE	Sep 18, 2024
`v2.9.1` patch 1 CVE	Jun 17, 2024
`v2.9.0` minor 1 CVE	Jun 16, 2024
`v2.8.2` minor 1 CVE	May 08, 2024
`v2.8.1` patch 1 CVE	Apr 11, 2024
`v2.8.0` minor 1 CVE	Feb 08, 2024
`v2.7.1` patch 1 CVE	Dec 09, 2023
`v2.7.0` minor 1 CVE	Dec 09, 2023
`v2.6.0` minor 1 CVE	Sep 06, 2023
`v2.5.1` patch 1 CVE	May 16, 2023
`v2.5.0` minor 1 CVE	May 13, 2023
`v2.4.1` patch 1 CVE	Mar 20, 2023
`v2.4.0` minor 1 CVE	Mar 08, 2023
`v2.3.1` minor 1 CVE	Dec 29, 2022
`v2.1.0` initial 1 CVE	Oct 17, 2022
`v2.0.0-beta.44.1` pre	Aug 20, 2022
`v2.0.0-beta.40.2` pre	Jul 25, 2022
`v2.0.0-beta.39.2` pre	Jul 19, 2022
`v2.0.0-beta.39.1` pre	Jul 19, 2022
`v2.0.0-beta.37` pre	May 27, 2022
`v2.0.0-beta.36` pre	May 01, 2022
`v2.0.0-beta.30` pre	Feb 04, 2022
`v2.0.0-beta.23` pre	Dec 15, 2021
`v2.0.0-beta.17` pre	Nov 08, 2021
`v2.0.0-beta.14` pre	Oct 22, 2021
`v2.0.0-beta.11` pre	Oct 11, 2021
`v2.0.0-beta.10` pre	Oct 10, 2021
`v2.0.0-beta.9` pre	Oct 10, 2021
`v2.0.0-beta.8` pre	Oct 08, 2021
`v2.0.0-beta.5` pre	Oct 08, 2021
`v2.0.0-beta.2` pre	Sep 28, 2021
`v2.0.0-beta.0` pre	Sep 27, 2021
`v2.0.0-alpha.64` pre	Apr 13, 2021
`v2.0.0-alpha.62` pre	Mar 31, 2021
`v2.0.0-alpha.54` pre	Mar 18, 2021
`v2.0.0-alpha.51` pre	Mar 14, 2021
`v2.0.0-alpha.48` pre	Mar 09, 2021
`v2.0.0-alpha.45` pre	Mar 05, 2021
`v2.0.0-alpha.43` pre	Mar 03, 2021

v2.17.0 minor

Oct 18, 2026

v2.16.0 minor

Sep 14, 2026

v2.15.0 minor

Aug 17, 2026

v2.14.0 minor

Aug 10, 2026

v2.13.0 minor

Jul 06, 2026

v2.12.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Mar 26, 2026

v2.11.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Nov 08, 2025

v2.10.2 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Jul 06, 2025

v2.10.1 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Feb 24, 2025

v2.10.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Feb 14, 2025

v2.9.3 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Feb 12, 2025

v2.9.2 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Sep 18, 2024

v2.9.1 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Jun 17, 2024

v2.9.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Jun 16, 2024

v2.8.2 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

May 08, 2024

v2.8.1 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Apr 11, 2024

v2.8.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Feb 08, 2024

v2.7.1 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Dec 09, 2023

v2.7.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Dec 09, 2023

v2.6.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Sep 06, 2023

v2.5.1 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

May 16, 2023

v2.5.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

May 13, 2023

v2.4.1 patch

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Mar 20, 2023

v2.4.0 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Mar 08, 2023

v2.3.1 minor

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Dec 29, 2022

v2.1.0 initial

1 CVE

CVE-2026-34157 GHSA-47hv-j4px-h3c9 Oct 27, 2026

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

High

Network Low None

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

| | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop targets) |

Summary

Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction.

An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code execution depending on the application's exposed API surface.

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

https://myapp.community — different TLD
https://myapp.com.attacker.com — attacker-controlled subdomain
https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Impact

Any Go method registered with Wails bindings becomes callable from the attacker's origin. Depending on the application:

File system read / write (common in desktop apps)
Database queries
OS command execution (if exposed via bindings)
Sensitive configuration or credential access

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.

Disclosure Timeline

| Date | Event | |---|---| | 2026-03-26 | Vulnerability discovered during source code audit by @Saku0512 | | 2026-03-26 | Private report submitted via GitHub Security Advisory | | 2026-03-26 | Vendor acknowledgement and fix PR opened (#5074) | | TBD | Patch release | | TBD + 90 days | Public disclosure deadline |

Fixed in


          2.13.0

References

Updated Oct 27, 2026 · Source: OSV.dev

Oct 17, 2022

v2.0.0-beta.44.1 pre

Aug 20, 2022

v2.0.0-beta.40.2 pre

Jul 25, 2022

v2.0.0-beta.39.2 pre

Jul 19, 2022

v2.0.0-beta.39.1 pre

Jul 19, 2022

v2.0.0-beta.37 pre

May 27, 2022

v2.0.0-beta.36 pre

May 01, 2022

v2.0.0-beta.30 pre

Feb 04, 2022

v2.0.0-beta.23 pre

Dec 15, 2021

v2.0.0-beta.17 pre

Nov 08, 2021

v2.0.0-beta.14 pre

Oct 22, 2021

v2.0.0-beta.11 pre

Oct 11, 2021

v2.0.0-beta.10 pre

Oct 10, 2021

v2.0.0-beta.9 pre

Oct 10, 2021

v2.0.0-beta.8 pre

Oct 08, 2021

v2.0.0-beta.5 pre

Oct 08, 2021

v2.0.0-beta.2 pre

Sep 28, 2021

v2.0.0-beta.0 pre

Sep 27, 2021

v2.0.0-alpha.64 pre

Apr 13, 2021

v2.0.0-alpha.62 pre

Mar 31, 2021

v2.0.0-alpha.54 pre

Mar 18, 2021

v2.0.0-alpha.51 pre

Mar 14, 2021

v2.0.0-alpha.48 pre

Mar 09, 2021

v2.0.0-alpha.45 pre

Mar 05, 2021

v2.0.0-alpha.43 pre

Mar 03, 2021

github.com/wailsapp/wails/v2

Activity

Reach

Details