CWE-625: Permissive Regular Expression
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
17 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-55536 — Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
- CVE-2026-32973 — OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization
- CVE-2026-64940 — Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular exp
- CVE-2026-83618 — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
- CVE-2026-83617 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
- CVE-2026-83609 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
- CVE-2026-34830 — Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
- CVE-2026-19278 — Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
- CVE-2026-34763 — Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation
- CVE-2026-82726 — AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
- CVE-2026-79965 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-73845 — CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
- CVE-2026-44587 — CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
Recently published
- CVE-2026-79965 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-83618 — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
- CVE-2026-83617 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
- CVE-2026-83609 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
- CVE-2026-82726 — AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
- CVE-2026-55536 — Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
- CVE-2026-73845 — CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
- CVE-2026-19278 — Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
- CVE-2026-64940 — Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular exp
- CVE-2026-44587 — CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
- CVE-2026-34830 — Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
- CVE-2026-34763 — Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation
- CVE-2026-32973 — OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization
More specific weaknesses
- CWE-777 — Regular Expression without Anchors