{"id":"ghsa-ghsa-47hv-j4px-h3c9","seq":1708833,"kind":"advisory","title":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins","url":"https://github.com/advisories/GHSA-47hv-j4px-h3c9","permalink":"https://vulnpulse.app/items/ghsa-ghsa-47hv-j4px-h3c9","summary":"影響: go:github.com/wailsapp/wails/v2 >= 2.0.0, < 2.13.0 → 2.13.0\nSecurity Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop target…","severity":"high","techs":["go","github"],"cves":["CVE-2026-34157"],"tags":["GHSA-47hv-j4px-h3c9","github.com/wailsapp/wails/v2"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T13:29:47.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}