CWE-624: Executable Regular Expression Error
The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
Last updated
Overview
Case (2) is possible in the PHP preg_replace() function, and possibly in other languages when a user-controlled input is inserted into a string that is later parsed as a regular expression.
Real-world CVEs
1 recorded CVEs are caused by CWE-624 (Executable Regular Expression Error). The highest-severity and most recent are shown first. 1 new CWE-624 CVE has been recorded so far in 2026.
Common consequences
What can happen when CWE-624 is exploited.
Execute Unauthorized Code or Commands
Affects: Confidentiality, Integrity, Availability
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-624, grouped by where in the lifecycle they apply.
The regular expression feature in some languages allows inputs to be quoted or escaped before insertion, such as \Q and \E in Perl.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2006-2059 — Executable regexp in PHP by inserting "e" modifier into first argument to preg_replace
- CVE-2005-3420 — Executable regexp in PHP by inserting "e" modifier into first argument to preg_replace
- CVE-2006-2878 — Complex curly syntax inserted into the replacement argument to PHP preg_replace(), which uses the "/e" modifier
- CVE-2006-2908 — Function allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.
Terminology & mappings
Mapped taxonomies
- Software Fault Patterns: Tainted input to command (SFP24)
Frequently asked questions
Common questions about CWE-624.
- What is CWE-624?
- The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
- What CVEs are caused by CWE-624?
- 1 recorded CVEs are attributed to CWE-624, including CVE-2026-25237.
- How do you prevent CWE-624?
- The regular expression feature in some languages allows inputs to be quoted or escaped before insertion, such as \Q and \E in Perl.
- How is CWE-624 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-624?
- Exploiting CWE-624 can lead to: Execute Unauthorized Code or Commands.
- Is CWE-624 actively exploited?
- 1 recorded CVEs are caused by CWE-624; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-624) (opens in a new tab)
- CWE-624 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-624
Get alerted the moment a new CWE-624 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.