diff --git a/core/modules/system/src/MachineNameController.php b/core/modules/system/src/MachineNameController.php
index 9f4b572..26573cc 100644
--- a/core/modules/system/src/MachineNameController.php
+++ b/core/modules/system/src/MachineNameController.php
@@ -67,7 +67,9 @@ public function transliterate(Request $request) {
       $transliterated = Unicode::strtolower($transliterated);
     }
     if(isset($replace_pattern) && isset($replace)) {
-      $transliterated = preg_replace('@' . preg_quote($replace_pattern, '@') . '@', $replace, $transliterated);
+      // Quote the pattern delimiter and remove null characters to avoid the e
+      // or other modifiers being injected.
+      $transliterated = preg_replace('@' . strtr($replace_pattern, ['@' => '\@', chr(0) => ' ']) . '@', $replace, $transliterated);
     }
     return new JsonResponse($transliterated);
   }
diff --git a/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php b/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php
index 82d68d9..dc3bf3b 100644
--- a/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php
+++ b/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php
@@ -50,6 +50,8 @@ public function providerTestMachineNameController() {
       array(array('text' => 'Bob', 'langcode' => 'en', 'replace' => 'Alice', 'replace_pattern' => 'Tom'), '"Bob"'),
       array(array('text' => 'Äwesome', 'langcode' => 'en', 'lowercase' => TRUE), '"awesome"'),
       array(array('text' => 'Äwesome', 'langcode' => 'de', 'lowercase' => TRUE), '"aewesome"'),
+      array(array('text' => 'B?!"\/-ob', 'langcode' => 'en', 'lowercase' => TRUE, 'replace' => '_', 'replace_pattern' => '[^a-z0-9_.]+'), '"b_ob"'),
+      array(array('text' => 'B?!"\/-ob@e', 'langcode' => 'en', 'lowercase' => TRUE, 'replace' => '_', 'replace_pattern' => '[^a-z0-9_.]+'), '"b_ob_e"'),
     );
   }