CWE-625: Permissive Regular Expression

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include: not identifying the beginning and end of the target string using wildcards instead of acceptable character ranges others

Consequences

• Access Control: Bypass Protection Mechanism

How to prevent it

• Implementation: When applicable, ensure that the regular expression marks beginning and ending string patterns, such as "/^string$/" for Perl.

Recent advisories

• GHSA-vr34-hp96-76pp — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
• GHSA-jxjr-3g7g-3944 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
• GHSA-3px3-54cx-rmw9 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
• EEF-CVE-2026-82726 — AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
• GHSA-6g6r-q6gw-w8fg — PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
• GHSA-7g26-2qgj-chfg — CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
• GHSA-qv7j-4883-hwh7 — Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect
• GHSA-7mqq-6cf9-v2qp — Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory
• GHSA-f8r2-vg7x-gh8m — OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths
• GHSA-46c8-635v-68r2 — Keycloak Authorization Bypass vulnerability

All advisories for CWE-625