Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

影響: go:github.com/wailsapp/wails/v2 >= 2.0.0, < 2.13.0 → 2.13.0

Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern | | | |---|---| | Product | wailsapp/wails (v2) | | Affected File | v2/internal/frontend/originvalidator/originValidator.go | | Affected Versions | All versions containing originValidator (latest as of 2026-03-26) | | CVSSv4.0 | 7.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N | | CWE | CWE-625: Permissive Regular Expression | | Platforms | Windows / Linux / macOS (all desktop target…

在 GitHub Advisory Database 阅读

2026/10/27 22:29，GitHub Advisory Database 发布了“Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Go、GitHub。CVE：CVE-2026-34157。