CVE-2026-34157

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34157", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T20:12:04.196Z", "datePublished": "2026-11-05T20:26:04.218Z", "dateUpdated": "2026-11-09T18:28:05.289Z"}, "containers": {"cna": {"title": "Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins", "problemTypes": [{"descriptions": [{"cweId": "CWE-625", "lang": "en", "description": "CWE-625: Permissive Regular Expression", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9"}, {"name": "https://github.com/wailsapp/wails/pull/5074", "tags": ["x_refsource_MISC"], "url": "https://github.com/wailsapp/wails/pull/5074"}, {"name": "https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81", "tags": ["x_refsource_MISC"], "url": "https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81"}, {"name": "https://github.com/wailsapp/wails/releases/tag/v2.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/wailsapp/wails/releases/tag/v2.13.0"}], "affected": [{"vendor": "wailsapp", "product": "wails", "versions": [{"version": ">= 2.0.0, < 2.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:26:04.218Z"}, "descriptions": [{"lang": "en", "value": "Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0."}], "source": {"advisory": "GHSA-47hv-j4px-h3c9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T18:27:44.071573Z", "id": "CVE-2026-34157", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T18:28:05.289Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34157", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T18:27:44.071573Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T18:27:55.527Z"}}], "cna": {"title": "Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins", "source": {"advisory": "GHSA-47hv-j4px-h3c9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "wailsapp", "product": "wails", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.13.0"}]}], "references": [{"url": "https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9", "name": "https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wailsapp/wails/pull/5074", "name": "https://github.com/wailsapp/wails/pull/5074", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81", "name": "https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wailsapp/wails/releases/tag/v2.13.0", "name": "https://github.com/wailsapp/wails/releases/tag/v2.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-625", "description": "CWE-625: Permissive Regular Expression"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:26:04.218Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34157", "state": "PUBLISHED", "dateUpdated": "2026-11-09T18:28:05.289Z", "dateReserved": "2026-03-25T20:12:04.196Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T20:26:04.218Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wails", "vendor": "wailsapp", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.13.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wails is a framework for building desktop applications using Go and web technologies. From 2.0.0 until 2.13.0, BindingsAllowedOrigins in v2/internal/frontend/originvalidator/originValidator.go passes wildcard patterns to wildcardPatternToRegex, which expands every asterisk to an unrestricted regular-expression match. When an application configures a trailing or partial-label wildcard immediately after an allowed domain, an attacker-controlled lookalike origin can match the allowed suffix and invoke bound Go methods through IPC. A complete-component subdomain wildcard is an unaffected configuration. The resulting confidentiality, integrity, and availability impact depends on the file, database, command, credential, or other operations exposed by the application's bound methods. This issue is fixed in version 2.13.0."}], "id": "CVE-2026-34157", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34157", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T18:27:44.071573Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:47.300", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81"}, {"source": "security-advisories@github.com", "url": "https://github.com/wailsapp/wails/pull/5074"}, {"source": "security-advisories@github.com", "url": "https://github.com/wailsapp/wails/releases/tag/v2.13.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-625"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/wailsapp/wails: Wails: Origin validation bypass via permissive wildcard matching", "id": "2567876", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567876"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-625", "details": ["A flaw was found in Wails. The framework's origin validation logic converts wildcard patterns into overly permissive regular expressions, allowing lookalike web origins to bypass access controls when partial or trailing wildcards are configured. A remote attacker controlling a matching domain can exploit this flaw to invoke backend Go methods through Inter-Process Communication (IPC). Depending on the exposed application bindings, this can result in arbitrary command execution, unauthorized file system access, or sensitive data disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-34157", "public_date": "2026-11-05T20:26:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34157\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34157\nhttps://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81\nhttps://github.com/wailsapp/wails/pull/5074\nhttps://github.com/wailsapp/wails/releases/tag/v2.13.0\nhttps://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9"], "statement": "This vulnerability is rated as an Important impact because successful exploitation enables an untrusted origin to bypass origin validation and invoke sensitive backend functions, posing substantial risks of arbitrary command execution or unauthorized data exposure. Red Hat Enterprise Linux does not ship or support Wails as a core system component; however, custom or third-party desktop utilities compiled using this framework on Red Hat platforms may be exposed. Exploitation requires victim interaction to visit a spoofed domain and specifically depends on applications configuring non-standard trailing wildcards rather than exact origins or standard subdomain wildcards.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "wails", "vendor": "wailsapp"}], "created": "2026-11-05T21:45:05.121253+00:00", "updated": "2026-11-06T16:35:02.799734+00:00", "vendors": ["wailsapp", "wailsapp$PRODUCT$wails"]}