CWE-625 Permissive Regular Expression
Description
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-625 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-3jqq-pw4j-pqcj | CVE-2026-102830 | MODERATE |
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) |
2026-10-01 | |
| GHSA-4233-jc72-56c5 | CVE-2026-102983 | MODERATE |
Astro: Netlify Image CDN allowlist bypass enables SSRF |
2026-09-30 | |
| GHSA-jxjr-3g7g-3944 | CVE-2026-83617 | HIGH |
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator |
2026-09-08 | |
| GHSA-3px3-54cx-rmw9 | CVE-2026-83609 | HIGH |
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path |
2026-09-08 | |
| GHSA-vr34-hp96-76pp | CVE-2026-83618 | HIGH |
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator |
2026-09-08 | |
| GHSA-83x6-42hr-jc76 | CVE-2026-73845 | MODERATE |
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) |
2026-09-02 | |
| GHSA-6g6r-q6gw-w8fg | CVE-2026-55536 | CRITICAL |
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) |
2026-08-25 | |
| GHSA-24qx-w28j-9m6p | CVE-2026-40110 | HIGH |
Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat` |
2026-07-31 | |
| GHSA-qv7j-4883-hwh7 | CVE-2026-34830 | MODERATE |
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect |
2026-05-13 | |
| GHSA-7mqq-6cf9-v2qp | CVE-2026-34763 | MODERATE |
Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory |
2026-05-13 | |
| GHSA-f8r2-vg7x-gh8m | - | MODERATE |
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths |
2026-03-13 | |
| GHSA-46c8-635v-68r2 | CVE-2023-6544 | MODERATE |
Keycloak Authorization Bypass vulnerability |
2024-04-25 |