## Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- CVE: CVE-2026-34157
- 公開日時: 2026-10-27T13:29:47.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-47hv-j4px-h3c9)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-47hv-j4px-h3c9

影響: go:github.com/wailsapp/wails/v2 >= 2.0.0, < 2.13.0 → 2.13.0
Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop target…