Wails: Origin validator bypass via wildcard pattern (CVE-2026-34157)

Wails v2 contains a vulnerability in the wildcardPatternToRegex function within originValidator.go. The implementation incorrectly replaces wildcards (*) with unanchored regex matchers (.*). Developers using a trailing wildcard pattern (e.g., myapp.com*) in BindingsAllowedOrigins inadvertently create a bypass, as the regex fails to restrict matches to legitimate domain boundaries. An attacker can craft a malicious origin (e.g., myapp.com.attacker.com or myapp.community) to invoke bound Go methods, leading to unauthorized actions such as file system access or command execution. The issue is addressed in PR #5074, which restricts wildcard expansion to full domain components.

Impact

If a Wails application exposes sensitive bindings, an attacker-controlled origin can execute those methods. Observed potential impacts include unauthorized file system read/write, credential exfiltration, and execution of OS commands if mapped to the application frontend.

Recommendation

• Upgrade Wails to version 2.13.0 or later once released.
• Audit existing BindingsAllowedOrigins configurations in Wails applications. Ensure wildcard patterns are used only for full domain components (e.g., https://*.myapp.com) and avoid trailing wildcards on partial labels (e.g., myapp.com*).
• Review exposed Go methods in application bindings to ensure they follow the principle of least privilege.