Wails v2 CVE-2026-34157

Exploitable ONLY when the developer has configured Wails BindingsAllowedOrigins with a trailing/partial-label wildcard (e.g. 'https://myapp.com*'), which the advisory describes as a natural misuse; the officially documented subdomain-prefix pattern 'https://*.myapp.com' is NOT affected, and default configurations without such a wildcard are not vulnerable. The attacker must additionally control a domain that shares the literal prefix of the configured pattern (e.g. myapp.community, myapp.com.attacker.com, or any myapp.comXXXXX suffix), and that attacker origin must be loaded by the Wails application's webview, i.e. user/webview interaction is required (UI:P). Limiting factors: non-default misconfiguration required, required interaction to load the malicious origin, and the realized impact is bounded by which Go methods the specific application exposes via bindings.

The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N, 7.6 HIGH) is the only quantitative signal; NVD provides no base score (CVSS: N/A), and there is no EPSS value, no CISA KEV listing, and no public exploit code - only vendor advisory and fix references. These signals converge on a conditional rather than broadly urgent risk: the network vector (AV:N) and unauthenticated attacker (PR:N) look severe, but AT:P and UI:P encode two real brakes - the flaw manifests ONLY when a developer misconfigures BindingsAllowedOrigins with a trailing wildcard like 'myapp.com*' (the documented/default 'https://*.myapp.com' subdomain pattern is explicitly NOT vulnerable), and a victim-side user/webview interaction is needed to load the attacker origin. So this is a genuine HIGH-severity authorization bypass but not a widespread drive-by: absence from KEV and no EPSS/exploit signal, combined with the non-default-config precondition, point to targeted, opportunistic exploitation of misconfigured apps rather than mass exploitation. The vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with prioritized-but-not-fire-drill patching; a fix is available in version 2.13.0, so the correct action is to upgrade this week and audit BindingsAllowedOrigins for trailing-wildcard misuse. Note the impact ceiling (file access, data exfiltration, possible command execution) is itself conditional on what Go methods each application binds - the CVE describes the bypass mechanism, not a guaranteed RCE.

A developer configures Wails BindingsAllowedOrigins with a trailing wildcard such as 'https://myapp.com*', which compiles to the permissive regex ^https://myapp\.com.*$; an attacker registers a prefix-matching domain (e.g. myapp.community or myapp.com.attacker.com) and gets the app's webview to load that attacker origin. Because the regex suffix-matches, the attacker's page passes origin validation and can invoke any bound Go backend method over IPC, reading or writing files or exfiltrating data depending on the application's exposed bindings. No public exploit code was identified at time of analysis, and exploitation depends on both the non-default trailing-wildcard misconfiguration and user/webview interaction (UI:P).