It happens when software does not escape matching delimiter pairs such as brackets, braces or parentheses, so attacker input can alter grouping or nesting in a parser. Defenders should check how each target syntax handles paired delimiters, validate structure before use, and escape or encode delimiters when data enters that syntax.
How paired delimiters fail to sanitise
Paired delimiters fail when input is passed into a syntax that treats bracket-like characters as structure, but the application only escapes some characters or escapes them in the wrong layer. That lets an attacker close, open, or rebalance grouping in the target parser, so the resulting structure is no longer what the developer intended.
The core issue is not just “special characters in general”; it is that the software lets user-controlled data participate in nesting rules. A single unmatched delimiter may break parsing, but a matched pair can be more dangerous because it can shift where later content is interpreted, especially in templates, expressions, or nested document formats.
Where the parser gets tricked
Different syntaxes use paired delimiters for different purposes, so the same input can be harmless in one context and dangerous in another. Brackets, braces, and parentheses can control arrays, objects, function calls, regular-expression groups, templating blocks, and code fragments, which means sanitisation has to match the exact grammar that will consume the data.
That is why structural validation matters before encoding. If the application only strips a few characters, or assumes one delimiter pair is enough to “neutralise” the input, the parser may still accept a valid nested structure that changes meaning. The safe approach is to validate the allowed structure first, then encode for the target context, rather than relying on generic replacement.
The weakness is closely related to the broader class of delimiter-neutralisation problems described in the CWE Top 25 Guide, especially when input is reused across multiple syntaxes or generation layers. In those cases, the sink, not the source, determines which characters are truly dangerous.
Why context-specific escaping is the real fix
There is no single escape routine that safely handles every parser. A delimiter that is inert in JSON may be meaningful in a template engine, and a character that is safe in one output encoding may still change grouping in a downstream expression parser. Security depends on matching the escaping rule to the exact syntax boundary where the data is introduced.
That is also why developers should avoid double-handling the same value in multiple layers unless each layer has a clearly defined responsibility. If one component validates structure and another later reparses the same string, the second parser can reintroduce the original risk. The safer design is to keep untrusted data as data, not as syntax, until the final, context-aware encoding step.
Risk and Threat Considerations
Failure to sanitise paired delimiters can become a structure-confusion flaw, where attacker-controlled characters change how the parser groups or nests content. The impact ranges from broken validation to data leakage or injection into a downstream interpreter, depending on which syntax boundary is crossed.
Failure mechanism: The application accepts user input into a grammar that uses paired delimiters, but it does not escape or validate the full delimiter structure for that grammar. An attacker supplies a matching opener and closer, or an imbalanced sequence, to alter the parse tree.
Impact: The parser may treat attacker content as part of the structure rather than as literal data, which can change logic, bypass checks, or enable injection into templates, expressions, or generated output.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V1 — Encoding and Sanitization | Paired delimiters are an input-encoding and output-sanitization problem in parser-bound contexts. |
| Recommendation — Validate structure first, then apply context-appropriate encoding at the sink. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | The flaw is a software-input handling weakness that belongs in secure coding and validation practices. |
| Recommendation — Review parsing and input-handling logic for delimiter-neutralization weaknesses. | ||
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Delimiter abuse matters when input becomes executable syntax for an interpreter or parser. |
| Recommendation — Hunt for inputs that alter interpreter syntax or command structure. | ||
Practitioner Guidance
What to verify: Confirm the exact sink that consumes the value, then test the input against that parser rather than against a generic character blacklist. If the same field flows into more than one syntax, each destination needs its own encoding rule.
Common mistake: Treating delimiter removal as sufficient. Removing a few characters can still leave a valid nested form, and in some grammars that is enough for attacker input to regain structural meaning.
Decision rule: If the field is supposed to be plain text, reject any input that contains structural delimiters the business case does not require. If the field must support structured syntax, parse and validate the structure explicitly before any downstream use.
Practitioner takeaway: Do not think of paired delimiters as characters to scrub, think of them as syntax to govern. The control is only effective when the application knows which parser will see the value and applies escaping at that boundary.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org