{"id":"GO-2026-6862","summary":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails","details":"Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins in github.com/wailsapp/wails","aliases":["CVE-2026-34157","GHSA-47hv-j4px-h3c9"],"modified":"2026-11-05T23:15:14.506576848Z","published":"2026-11-05T22:54:32Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6862","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/wailsapp/wails/security/advisories/GHSA-47hv-j4px-h3c9"},{"type":"FIX","url":"https://github.com/wailsapp/wails/commit/bcc5941b72fdab6a13942b58871a2696faa85b81"},{"type":"FIX","url":"https://github.com/wailsapp/wails/pull/5074"}],"affected":[{"package":{"name":"github.com/wailsapp/wails/v2","ecosystem":"Go","purl":"pkg:golang/github.com/wailsapp/wails/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.13.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/wailsapp/wails/v2/internal/frontend/originvalidator","symbols":["OriginValidator.IsOriginAllowed","OriginValidator.wildcardPatternToRegex"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6862.json"}}],"schema_version":"1.9.2"}