Skip to content
OpenAdvisories

Weakness (CWE)

CWE-624: Executable Regular Expression Error

Base Incomplete

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

More detail

Case (2) is possible in the PHP preg_replace() function, and possibly in other languages when a user-controlled input is inserted into a string that is later parsed as a regular expression.

How to prevent it (1 mitigation)

  1. Implementation

    The regular expression feature in some languages allows inputs to be quoted or escaped before insertion, such as \Q and \E in Perl.

Source: MITRE CWE-624

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.2
    CVE-2026-25237

    PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails

    PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replac…

    pear pearweb