Skip to content
OpenAdvisories

Weakness (CWE)

CWE-777: Regular Expression without Anchors

Variant Incomplete

The product uses a regular expression to perform neutralization, but the regular expression omits one or more anchors that may allow malicious or malformed data to slip through.

How to prevent it (1 mitigation)

  1. Implementation

    Be sure to understand both what will be matched and what will not be matched by a regular expression. Anchoring the ends of the expression will allow the programmer to define an allowlist strictly limited to what is matched by the text in the regular expression. If you are using a package that only matches one line by default, ensure that you can match multi-line inputs if necessary.

Source: MITRE CWE-777

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-78191

    WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages

    WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application th…