The Regex Said Safe. The Parser Disagreed, NASA Earth Science Platform had a Critical Vulnerability

A sanitizer understood text. A parser understood XML grammar. The gap became a CVSS 9.1 bug in NASA Earth science infrastructure.