CWE-625: Permissive Regular Expression
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
A kind of CWE-185 Incorrect Regular Expression.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains junie cli In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar... 7.0 High
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list No score -
libcgi-pm-perlDebian,perl-CGIopenSUSE +1 more CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse No score - No product listed CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator 9.1 Critical
- wailsapp wails Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins 7.6 High
- gitlab Permissive Regular Expression in GitLab 8.2 High
- @astrojs netlify, withastro astro +1 more Astro: Netlify Image CDN allowlist bypass enables SSRF 6.3 Medium
- jupyterlab, jupyterlab jupyterlite-core +1 more JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) 6.8 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 5.3 Medium
- @xmldom xmldom xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator 8.7 High
- @xmldom xmldom xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator 8.7 High
- @xmldom xmldom xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path 8.7 High
- ash-project ash phoenix AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant 6.3 Medium
- mervinpraison praisonai Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) 9.1 Critical
- ondata ckan-mcp-server CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) 5.3 Medium
- red hat advanced cluster security 4 Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings 6.8 Medium
- nishishi factory tegalog -fumy otegaru memo logger- Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a... 8.8 High
-
sanic-corsPyPI sanic-cors contains an improper regular expression in the try_match() function 6.5 Medium - carrierwave project carrierwave CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters 4.7 Medium
- jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +1 more +3 more jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat 7.6 High
- rack Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx 5.9 Medium
- rack Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation 5.3 Medium
- openclaw OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization 8.8 High
- microsoft aci confidential containers Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability 6.7 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 more ReDoS Vulnerability in gaizhenbiao/chuanhuchatgpt 7.5 High
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7.6 for rhel 7 +4 more +6 more Keycloak: authorization bypass 5.4 Medium
- google closure-library, closure library +1 more Auth Bypass in Google's Closure-Library 6.5 Medium
- qnap systems inc. photo station Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station... 8.8 High