Executable Regular Expression Error

This vulnerability occurs when an application uses a regular expression that can execute code, either because it directly contains executable logic with unsafe user input, or because an attacker can inject pattern modifiers that enable code execution.

This flaw typically manifests in two ways. First, when user-supplied data is directly embedded into a regular expression pattern that gets evaluated as executable code, allowing an attacker to break out of the pattern context and run arbitrary commands. Second, and more subtly, when an attacker can inject special pattern modifiers (like the 'e' modifier in PHP's `preg_replace()`) that instruct the regex engine to execute the replacement string as code, effectively turning a simple text substitution into a remote code execution vulnerability. Developers should treat all user input destined for regex patterns as untrusted and avoid dynamically constructing patterns with it whenever possible. Special attention is required for functions like PHP's `preg_replace()` that historically supported the dangerous 'e' modifier, but the principle applies to any language or library where regex evaluation can cross into code execution. Always use safe, predefined patterns or rigorously validate and sanitize input to prevent modifier injection.