VNX-624: Regular expression replacement evaluated as code (preg_replace /e, s///ee)

Field	Value
Rule ID	VNX-624
Severity	Medium
SARIF level	warning
Kind	sast
Languages	PHP, Perl
CWE	CWE-624
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	regex-error code-injection cwe-624
Source	internal/sast/rules/vnx-624.rego

Overview

VNX-624 maps to CWE-624: Executable Regular Expression Error. Some regex engines can evaluate the replacement as code. With PHP’s /e modifier, or Perl’s double /ee, text the input controls reaches an eval. A pattern the client controls can also add the modifier itself on PHP before 7.

What Gets Flagged

return preg_replace('/\{\$(\w+)\}/e', '$vars["\\1"]', $tpl);
$text = preg_replace("#\[b\](.*?)\[/b\]#ie", "'<b>'.strtoupper('\\1').'</b>'", $text);
$s = mb_ereg_replace('([a-z]+)', 'strtoupper("\\1")', $s, 'e');
$out = preg_replace($_GET['pattern'], $_GET['replace'], $content);

$text =~ s/\$(\w+)/$param->{$1}/gee;

Not flagged: preg_replace_callback(), patterns with ordinary modifiers (i, s, m, u, x), user input passed only as the subject, Perl’s single /e, comments and string literals.

Remediation

return preg_replace_callback('/\{\$(\w+)\}/', fn ($m) => htmlspecialchars($vars[$m[1]] ?? ''), $tpl);

References

• CWE-624: Executable Regular Expression Error
• PHP manual: preg_replace_callback()

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-624
// nosec vnx-624

Or record an ignore rule: vulnetix ignore add --rule vnx-624 --reason "...". See Suppressing findings.