Regular expression built from user or model input
MediumAV-RUNTIME-018Runtime safetyCore packNew in 2.0
What it finds
A regular expression pattern comes straight from user, tool, or model input.
Why it matters
A crafted pattern can take minutes of CPU to evaluate (ReDoS), freezing the agent or the whole server.
What an attacker could do: Anyone who controls the input can make the service hang.
How to fix it
Escape input before putting it in a pattern (re.escape / escapeRegExp), or use a linear-time engine like RE2.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- REGEX_FROM_INPUT
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM04 - Model Denial of Service
- NIST AI RMF
- MG-2.2
- SOC 2
- A1.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High