CWE-624 (可执行体正则表达式错误) — Vulnerability Class 2

CWE-624 represents a critical weakness where regular expressions contain executable components influenced by user-controlled inputs or allow execution via inserted pattern modifiers. This vulnerability is typically exploited when attackers manipulate input to inject malicious code into the regex engine, effectively turning pattern matching into arbitrary code execution. For instance, in PHP’s preg_replace() function, an attacker might supply a string containing special modifiers that alter the regex behavior, leading to unintended side effects or remote code execution. To prevent this, developers must strictly validate and sanitize all user inputs before they are incorporated into regular expression patterns. Additionally, using safe APIs that do not support executable regex features or employing static analysis tools to detect dangerous patterns can significantly mitigate the risk of such exploits.