Engine Pack Version 9.7.6

CxSAST Engine

Warning

For compliance and security reasons, the CxSAST 9.7.6 Engine Docker image was updated.

The base image was migrated from Wolfi (apk-based) to a Debian-based distribution (apt-based).
- If you customize this image or use it as a base image, you may need to adjust the package download (e.g., move from apk get PACKAGE to apt get PACKAGE.
Some packages were also updated. The ca-certificates and openssl libraries are now using newer versions (version 3.5.5).

Languages & Frameworks

All supported code Languages & Frameworks versions can be found here.

Enhancements in false positive reduction and new true positive coverage. See here for more information.

C++

Finalized support for C++ 17, including:
- Added aggregate initialization support
Added support for C++ 20, including:
- Abbreviated function template
- Constraints and concepts
- Export/Import module
- Coroutines
- Removed the requirement to use typename to disambiguate types
Improved dependency computation to prevent result jumping due to file order loss.
Performance improvements to optimize the scanning execution time.

Go

New support and improvements were made to queries, see here for more information.

These updates aim to improve accuracy, reduce false positives, and increase coverage for Go code analysis.

JavaScript

Node.js support has been expanded to include file extensions .cjs, .mjs, .mts, and .cts

JSP

Improvements to the flows between different JSP Servlet Scopes, including Page, Request, Session, and Application.
Added dynamic resolution for EL expressions "${ }" in JSP views.

Python

Code Injection query for Pandas has been created.

Fast API support: Added full FastAPI coverage to the Python query set, see here for more information.

Post-Quantum Readiness

Proactive preparation is essential to ensure systems remain secure and compliant in the future quantum era while addressing the immediate risk posed by the “Capture now, decrypt later” problem, where organizations vulnerable now. To support this, the following queries have been added to Java, JavaScript, CSharp, Go and Python:

Weak_Post_Quantum_Cryptography (Low) to identify cryptographic algorithms considered weak in a post-quantum context, meaning they can be intercepted now and potentially decrypted in the future once quantum capabilities are available.
Compliant_Post_Quantum_Cryptography (Info) to identify the use of cryptographic algorithms that are considered safe and aligned with post-quantum security recommendations.

The Weak_Post_Quantum_Cryptography query has been added to the All, Checkmarx Default, High, Medium, and Low presets.

Additionally, a new preset named Post-Quantum Readiness has been created to include this query.

Large Language Model

A new Java query, Privacy_Violation_to_LLM (Medium), has been added to identify privacy risks in source code that interacts with Large Language Models, including both data sent as input to the LLM and data returned as output.

Compliance Standards

A new preset and category for the OWASP Top 10 2025 compliance standard has been added.

Engine Pack Supported Code Languages and Frameworks (9.7.6)

Note

The SAST engine supports scanning across languages and frameworks, regardless of their version. Unlike other tools, it does not require code compilation to perform the analysis.

Environment and Primary Languages

Secondary Languages

Framework

File extensions

Additional Information

Java
J2SE
J2EE

JavaScript
VBScript
PL\SQL
HTML5

ATG DSP Taglib
GWT
Hibernate
Google Guice
Java Server Faces (JSF)
JSP
JSTL FMT Taglib
OWASP ESAPI
MyBatis
PrimeFaces
Spring Boot
Spring MVC
Spring
Struts
Velocity

.java
.jsp
.jspf
.jsf
.tag
.tld
.mf
.xhtml
.vm
.gradle
.properties
.xml
.yml
.yaml

Java can be configured as a unified language with Scala.

Note

The SAST engine supports JSP files. However, JSP custom tag libraries (taglibs) are not currently supported.

C#
VB.NET

ASP.NET
JavaScript
VBScript
PL\SQL
HTML5

ASP.NET Core
ASP.Net Core Razor
ASP.Net MVC framework
Enterprise Libraries
ComponentArt
Entity framework
Hibernate.Net
Infragistics
iBatis
Telerik
Dapper
.Net Core
.Net Framework
.NET

.cs
.cshtml
.xaml
.vb
.config
.aspx
.ascx
.asax
.tag
.master
.xml

JavaScript [**]
VBScript
PL\SQL
HTML5

ASP.Net MVC framework

.asp
.inc

.bas
.vbp
.frm
.cls
.dsr
.ctl

C MISRA
C++ MISRA
Informix ESQL/C
MySQL
Boost library
stdlib library

.cpp
.c
.cc
.c++
.cxx
.hpp
.hh
.h++
.hxx
.h
.ec
.cmake
.pc
.pro
.ac
.am
.txt (related to CmakeLists)
.ph
.ixx

JavaScript

bWapp
CakePHP
OWASP ESAPI
Kohana
Symfony
Smarty
Zend

.php
.php3
.php4
.php5
.phtm
.phtml
.tpl
.ctp
.twig
.inc
.cgi
.env
.ini

Apex

VisualForce
Lightning (Aura)
Lightning Web Components

.apex
.apexp
.apxc
.page
.component
.cls
.trigger
.tgr
.object
.report
.workflow
-meta.xml
.xml

This is for Salesforce APEX only.

Ruby

Ruby on Rails

.rb
.rhtml
.rxml
.rjs
.erb
.cgi
.lock

JavaScript
Typescript

Ajax
Angular
AngularJS
Backbone
Cordova / PhoneGap
Handlebars
Hapi.JS
JQuery
Knockout
Kony Visualizer
Node.js
- Buffer
- CryptoJS
- ExpressJS
- File System
- Hapi
- Mongodb
- OracleDB
- Sequelize
Pug (Jade)
React Native
ReactJS
SAPUI5
VueJS
XS (SAP)
RequireJS

.js
.jsx
.htm
.html
.json
.ts
.tsx
.aspx
.ascx
.xsjs
.xsjslib
.xsaccess
.xsapp
.app
.evt
.cmp
.hbs
.handlebars
.jade
.pug
.vue
.xml
.apexp
.page
.component
.cshtml
.jsf
.xhtml
.jsp
.jspf
.asp
.master
.php
.mjs
.cjs
.mts
.cts

VBScript

.vbs
.aspx
.ascx
.asp
.cshtml
.html
.htm
.master

Perl

.pl
.pm
.plx
.psgi
.cgi

Android (Java)

Volley

.java
.kt

Objective-C
Swift

.m
.h
.swift
.xib
.plist

HTML 5

.html
.htm

PL/SQL

.pls
.sql
.pkh
.pks
.pkb
.pck

SQL

.sql
.tsql

Python

JavaScript
VB script
PL\SQL

Django
Flask
Jinja and DTL
Pandas library
Marshmallow

.py
.gtl
.csv
.latex
.tex
.html
.xml
.txt

Groovy

JavaScript
VB script
PL\SQL

.groovy
.gsh
.gvy
.gy
.gsp
.gradle

Scala

Akka
Finagle
Finatra

.scala
.conf

Scala can be configured as a unified language with Java.

GO Language

Protobuf
gin-gonic/gin
gorilla-mux

.go
.mod

Kotlin

Ktor (Server Side)
Vert.x (Server Side)
Spring

.kt
.kts
.mustache
.ftl
.xml

Cobol

.cbl
.cob
.eco
.pco
.sqb
.cpy

.rpg
.rpg38
.sqlrpg
.rpgle
.sqlrpgle
.dspf

Dart

Flutter

.dart
.yaml

OpenResty

.lua
.conf

Rust

.rs
.toml

SAST Engine Pack Version 9.7.6 - Go Frameworks

Overview

CxQL version 9.7.6 introduces enhanced security analysis for Go applications with 44 new and updated queries, expanding framework support and language-specific detection capabilities. All new queries are backward compatible. Existing query implementations remain unchanged. New queries are additive only and do not modify existing detection logic. This release focuses on emerging threats, modern cryptography compliance, and support for the latest Go ecosystem frameworks.

New Framework Support

1. LDAP Framework Support (NEW)

Detection of LDAP injection vulnerabilities in Go applications using LDAP directory services.

Supported Package: ldap package

LDAP Operations Tracked:

NewAddRequest() - Adding directory entries
NewModifyRequest() - Modifying directory entries
NewDelRequest() - Deleting directory entries
Compare() - Comparing attribute values
NewSearchRequest() - Searching directory

New Queries:

LDAP_Injection (CWE-90) - Detects LDAP injection in untrusted inputs
Stored_LDAP_Injection (CWE-90) - Detects LDAP injection from stored data
Find_LDAP_Injection - Helper query for LDAP injection sources and sinks

Related Severity: High Risk

2. XPath/XML Query Support (ENHANCED)

Enhanced detection of XPath injection vulnerabilities with improved framework coverage.

Supported Packages:

xpath package - XPath query execution
xmlquery package - XML document querying

New Queries:

XPath_Injection (CWE-643) - Detects dynamic XPath injection
Stored_XPath_Injection - Detects XPath injection from stored inputs
Find_XPath_Injection_Outputs - Identifies XPath query sinks
Find_XPath_Injection_Sanitizers - Tracks XPath sanitization methods

Related Severity: Medium Threat

3. Database ORM Frameworks (EXPANDED)

Significant expansion of database framework coverage for SQL injection detection.

a) GORM (ORM Framework)

Explicit support for GORM's Query Builder and Raw SQL execution
New Queries: Find_GORM_DB_In, Find_GORM_DB_Out, Find_GORM_SQL_Injection_Sanitizers

b) Beego Framework

Enhanced ORM support with Built-in SQL execution detection
New Queries: Find_Beego_BuiltIn_SQL_Execution, Find_Beego_ORM, Find_Beego_DB_In/Out, Find_Beego_SQL_Injection_Sanitizers

c) Meddler ORM (NEW)

Full support for Meddler ORM - a lightweight database layer
Supported Methods: Insert(), Save(), Update(), QueryRow(), QueryAll()
New Queries: Find_Meddler_DB_In, Find_Meddler_DB_Out, Find_Meddler_Methods, Find_Meddler_SQL_Injection_Sanitizers

d) PostgreSQL (go-pg ORM) (ENHANCED)

Explicit PostgreSQL ORM support via go-pg package
New Queries: Find_PostGres_DB_In/Out, Find_PostGres_SQL_Injection_Sanitizers

e) Standard Go SQL Package (ENHANCED)

More explicit tracking of Go's native database/sql package
Improved data flow analysis for direct SQL execution
New Queries: Find_Std_SQL_DB_In/Out/Conn, Find_Std_SQL_Injection_Sanitizers

f) Cassandra Database (ENHANCED)

Enhanced support for Cassandra NoSQL operations
New Queries: Find_Cassandra_DB_In/Out, Find_Cassandra_SQL_Injection_Sanitizers

Total Database Frameworks Supported: 8+

Related Severity: Critical Risk, High Risk

6. Go Language Features (NEW)

a) Concurrency & Mutex Safety

New support for Go's synchronization primitives
Tracks: sync.Mutex, sync.RWMutex lock/unlock operations
Query: Improper_Locking (CWE-667) - Detects missing or improper mutex protection

b) TLS/Cryptography

Enhanced TLS configuration analysis with modern cipher suite support
Query: Insecure_TLS_Configuration ( CWE-326)
Tracks: TLS 1.2, TLS 1.3, AES-GCM, ECDHE, ChaCha20-Poly1305
Detects insecure cipher suites and protocol downgrade vulnerabilities

c) Template Injection (SSTI)

New support for Server-Side Template Injection detection
Supported Packages: html/template, text/template
Query: Server_Side_Template_Injection (QueryId: 9049, CWE-1336)
Detects unescaped user input in server-side templates

d) Plugin System

New support for Go's dynamic plugin loading
Tracks: plugin.Open() calls with untrusted plugin paths
Query: Dangerous_File_Inclusion (CWE-829)

New Security Detections

New Vulnerability Queries

Query	CWE	Category	Description
`Server_Side_Template_Injection`	1336	Critical Risk	Detects SSTI in Go templates
`LDAP_Injection`	90	High Risk	Detects LDAP directory injection
`Stored_LDAP_Injection`	90	High Risk	Detects stored LDAP injection
`Dangerous_File_Inclusion`	829	High Risk	Detects plugin path traversal
`XPath_Injection`	643	Medium Threat	Detects XPath query injection
`Stored_XPath_Injection`	643	Medium Threat	Detects stored XPath injection
`Length_Extension_Attack`	326	Medium Threat	Detects hash function vulnerabilities (MD5, SHA1, SHA256, SHA512)
`Insecure_TLS_Configuration`	326	Medium Threat	Detects weak TLS/SSL configurations
`Improper_Locking`	667	Medium Threat	Detects missing mutex protection
`Encoding_Used_Instead_of_Encryption`	327	Medium Threat	Detects misuse of encoding vs encryption
`Uncontrolled_Memory_Allocation`	770	Medium Threat	Detects potential DoS through memory exhaustion

New Low Visibility Detections

Improper_Transaction_Handling - Database transaction management
Improper_Resource_Shutdown_or_Release - Resource cleanup issues
Heap_Inspection - Memory inspection vulnerabilities
Cookie_Overly_Broad_Path - Overly permissive cookie path settings
Incorrect_Permission_Assignment_For_File_System_Resources - File permission issues
Misconfigured_X_Content_Type_Options - Missing MIME type protection headers
Missing_Framing_Policy - Missing clickjacking protection (X-Frame-Options)
Weak_Post_Quantum_Cryptography - Deprecated PQC algorithms
Off_by_One_Error - Index boundary errors
Trust_Boundary_Violation_in_Session_Variables - Session variable validation
Insufficient_Session_Expiration - Session timeout issues
Deprecated_Modules_Libraries_or_Packages - Tracking of deprecated dependencies

SAST Engine Pack Version 9.7.6 - Python FastAPI Support Enhancements

Python FastAPI Support

SAST Engine Pack Version 9.7.6 adds full FastAPI coverage to the Python query set. Five new helper queries provide the foundation, and they are plugged into existing vulnerability queries so that FastAPI applications are now detected on par with Django and Flask.

New Helper Queries

Find_FastAPI_RoutedMethods

Identifies all functions decorated with FastAPI route decorators (@app.get, @app.post, @app.put, @app.patch, @app.delete, @app.options, @app.head, @app.trace). Works for both FastAPI() and APIRouter() instances. This is the anchor for all other FastAPI helpers — route-scoped input and output detection depends on it.

Find_FastAPI_Inputs

Marks FastAPI route function parameters as taint sources. Covers:

Typed route/query/body parameters declared in routed function signatures
request.json, request.form, request.body, request.url, request.cookies, request.query_params, request.path_params, request.headers from injected Request objects

False positive reduction built in: parameters typed as int, float, decimal, or bool are excluded from sources (safe by type). Query parameters with numeric constraint validators (ge, gt, le, lt) or a safe regex pattern are also excluded when used with Annotated[...].

Find_FastAPI_Outputs

Marks return values of routed functions as taint sinks. Excludes direct Response object returns (tracked separately) to avoid noise on response wrappers that do not render user data directly.

Find_FastAPI_XSS_Outputs

Specialized XSS sink detection for FastAPI HTML-rendering patterns:

Functions with response_class=HTMLResponse using .format() on their return value
HTMLResponse(content=...) direct instantiation
Response(media_type="text/html") / "application/xml" / "application/html"
Jinja2 | safe filter output — data piped through safe in a template is now a tracked XSS sink

Find_FastAPI_Overly_Permissive_CORS

Detects CORSMiddleware configured with allow_origins=["*"] (or any wildcard string) on a FastAPI application instance via app.add_middleware(CORSMiddleware, ...).

Query Coverage Matrix

Queries now active for FastAPI applications. Helper queries (General) carry no severity of their own — they feed the vulnerability queries below.

Helper Queries (New)

Query	Purpose
`Find_FastAPI_RoutedMethods`	Identifies all `@app.get/post/put/patch/delete/...` decorated functions for both `FastAPI()` and `APIRouter()` instances
`Find_FastAPI_Inputs`	Taint sources: route/query/body parameters and `Request` object members (`json`, `form`, `body`, `cookies`, `headers`, `query_params`, `path_params`)
`Find_FastAPI_Outputs`	Taint sinks: return values from routed functions (excludes bare `Response` wrappers)
`Find_FastAPI_XSS_Outputs`	XSS-specific sinks: `HTMLResponse`, `response_class=HTMLResponse`, `media_type="text/html/xml"`, Jinja2 `\| safe` filter
`Find_FastAPI_Overly_Permissive_CORS`	Detects `CORSMiddleware` with `allow_origins=["*"]` on a FastAPI app instance

Vulnerability Queries — Now Active for FastAPI

Query	Severity	CWE	Description
`SQL_Injection`	Critical	CWE-89	User-controlled data from FastAPI route params flows into raw SQL execution
`Second_Order_SQL_Injection`	Critical	CWE-89	Stored FastAPI input flows into SQL execution in a later request
`Code_Injection`	Critical	CWE-94	FastAPI route params flow into `exec()`, `eval()`, or `compile()`
`Stored_Code_Injection`	Critical	CWE-94	Stored FastAPI input flows into dynamic code execution
`Command_Injection`	Critical	CWE-77	FastAPI route params flow into `os.system`, `subprocess`, or similar shell execution
`Stored_Command_Injection`	Critical	CWE-77	Stored FastAPI input flows into OS command execution
`Stored_XSS`	Critical	CWE-79	Stored input flows into an `HTMLResponse` or Jinja2 `\| safe` output in a FastAPI route
`Reflected_XSS`	High	CWE-79	FastAPI route params flow directly into `HTMLResponse`, `media_type="text/html"`, or `response_class=HTMLResponse`
`Path_Traversal`	High	CWE-22	FastAPI route params flow into file system operations without canonicalization
`SSRF`	High	CWE-918	FastAPI route params flow into outbound HTTP requests
`LDAP_Injection`	High	CWE-90	FastAPI route params flow into LDAP queries
`Stored_LDAP_Injection`	High	CWE-90	Stored FastAPI input flows into LDAP queries
`Deserialization_of_Untrusted_Data`	High	CWE-502	FastAPI route params flow into `pickle.loads`, `yaml.load`, or similar deserialization
`Improper_Restriction_of_XXE_Ref`	High	CWE-611	FastAPI route params flow into XML parsers without XXE protection
`Local_File_Inclusion`	High	CWE-829	FastAPI route params used to include local files
`Connection_String_Injection`	High	CWE-99	FastAPI route params flow into database connection string construction
`Open_Redirect`	Medium	CWE-601	FastAPI route params flow into redirect responses
`Header_Injection`	Medium	CWE-113	FastAPI route params flow into HTTP response headers
`Resource_Injection`	Medium	CWE-99	FastAPI route params used to reference system resources
`Parameter_Tampering`	Medium	CWE-472	FastAPI route params alter application behavior through unsafe direct use
`XPath_Injection`	Medium	CWE-643	FastAPI route params flow into XPath query construction
`Privacy_Violation`	Medium	CWE-359	Sensitive personal data from FastAPI inputs flows into logs or external outputs
`Uncontrolled_Format_String`	Medium	CWE-134	FastAPI route params used in uncontrolled `%`-formatting or f-strings passed to sinks
`Command_Argument_Injection`	Medium	CWE-88	FastAPI route params injected as arguments into OS commands
`Stored_Command_Argument_Injection`	Medium	CWE-88	Stored FastAPI input injected as OS command arguments
`HttpOnly_Cookie_Flag_Not_Set`	Medium	CWE-1004	`Response.set_cookie()` in FastAPI routed functions called without `httponly=True`
`Secure_Cookie_Flag_Not_Set`	Medium	CWE-614	`Response.set_cookie()` in FastAPI routed functions called without `secure=True`
`Overly_Permissive_CORS`	Low	CWE-346	`CORSMiddleware` added to FastAPI app with `allow_origins=["*"]`
`Log_Forging`	Low	CWE-117	FastAPI route params flow into log statements without sanitization
`Trust_Boundary_Violation_in_Session_Variables`	Low	CWE-501	FastAPI route params stored in session without validation

Impact on Existing Vulnerability Queries

The new helpers are wired into the shared query infrastructure, so existing vulnerability queries automatically gain FastAPI coverage:

Existing Query	What Changed
All taint-flow queries (SQL Injection, Command Injection, Path Traversal, SSRF, Code Injection, XXE, etc.)	`Find_Interactive_Inputs()` now includes `Find_FastAPI_Inputs()` — FastAPI route parameters are taint sources for every query that calls `Find_Interactive_Inputs()`. In v974 they were invisible to all of these queries.
Reflected XSS, Stored XSS	`Find_XSS_Outputs()` now includes `Find_FastAPI_XSS_Outputs()` — `HTMLResponse`, `response_class=HTMLResponse`, and `media_type="text/html"` patterns are now XSS sinks.
Overly Permissive CORS	`Overly_Permissive_Cross_Origin_Resource_Sharing_Policy` now calls `Find_FastAPI_Overly_Permissive_CORS()` alongside the existing Django check. Wildcard `allow_origins` in FastAPI middleware was not reported in v974.
HttpOnly Cookie Flag Not Set	Query now checks `Response.set_cookie(httponly=True)` in FastAPI routed functions. Missing or explicitly `False` `httponly` flag on FastAPI cookie responses is now reported.
Secure Cookie Flag Not Set	Same as above for the `secure` parameter — `Response.set_cookie(secure=True)` is now validated in FastAPI context.

Accuracy Gains: Enhancements in False Positive Reduction and New True Positive Coverage

False Positive Reduction

JavaScript — SQL Injection: Added Find_Parameterized_SQL_Strings() exclusion at the sink level — queries built with parameterized strings are no longer flagged, removing a common FP class in Node.js apps.
Python — Code Injection: Pandas sinks are now excluded from the generic Code Injection sink list (Find_Pandas_Code_Injection_Outputs subtracted before flow calculation), preventing Pandas eval() / query() flows from being incorrectly reported as general code injection. Sanitizer support also added via Find_Code_Injection_Sanitizers().
JavaScript — Stored XSS: Stored input source detection unified into NodeJS_Find_Stored_Inputs() helper (excluding local inputs), replacing an explicit fragmented list of DB output methods — improves precision of stored flow tracking and reduces noise from local variable sources.
iOS — Third Party Keyboard: Find_Swift_Third_Party_Keyboard_Enabled refactored to use a new Find_Swift_Third_Party_Keyboard_Safe_Application_Methods helper for proper exclusion of safe methods, reducing FPs where the keyboard restriction was correctly implemented.

New True Positive Coverage

Go

Server-Side Template Injection (Critical): New query for Go html/template / text/template unsafe construction — previously undetected attack surface.
LDAP Injection & Stored LDAP Injection (High): New queries; Go LDAP libraries had no coverage in v974.
XPath Injection & Stored XPath Injection (Medium): New queries with dedicated sink and sanitizer helpers.
Dangerous File Inclusion & Stored variant (High/Medium): plugin.Open and template.ParseFiles now tracked as sinks.
20+ medium/low-visibility checks (CSRF, Insecure TLS, Cookie Overly Broad Path, Heap Inspection, Missing Framing Policy, Insufficient Session Expiration, Off-by-One Error, etc.): Go was missing these checks that already existed in other languages.

Python

Pandas Code Injection & Stored variant (Critical): pandas.DataFrame.query() and pandas.eval() are now tracked as code injection sinks — data analysis pipelines passing user input to these methods are now detected.
FastAPI Sources: New Find_FastAPI_Inputs / Find_FastAPI_Outputs helpers mean FastAPI route parameters are now correctly identified as taint sources for all vulnerability queries.

Java / JavaScript / Go — LLM Data Exposure

Privacy_Violation_in_LLM, PCI_Data_Exposure_to_LLM, Secret_Leak_to_LLM: New queries detecting PII/secrets/PCI data flowing to LLM APIs (OpenAI, Anthropic Claude, GitHub Copilot, Google Gemini) — a previously uncovered data exfiltration channel.

CSharp / Go / Java / JavaScript / Python — Post-Quantum Cryptography

Weak_Post_Quantum_Cryptography: Detects use of quantum-vulnerable algorithms (RSA, ECDSA, AES, SHA-1/2/3) where PQC-safe alternatives are required.
Compliant_Post_Quantum_Cryptography: Confirms correct use of PQC-safe algorithms (ML-KEM, ML-DSA) for compliance verification.

Source / Sink / Sanitizer Gaps Closed

Go — ORM coverage: 5 previously unsupported database frameworks now covered (GORM, Meddler, PostgreSQL driver, standard database/sql, Cassandra improvements). SQL Injection queries through these ORMs were producing no results in v974.
JavaScript — Stored sources: NodeJS_Find_Inputs() now includes NodeJS_Find_Stored_Inputs() (replaces NodeJS_Find_Read()), meaning all queries that call this helper gain stored-source taint tracking automatically.
Python — Stored sources: Find_Inputs() now includes Find_Stored_Inputs(), extending stored-source coverage to all Python queries depending on this helper.
PHP — CLI inputs: Find_Local_Inputs (renamed from Find_Interactive_Local_Inputs) no longer gates CLI input sources behind the useConsoleInputs flag — argv, stdin, readline are always tracked, closing a gap in CLI PHP application coverage.
Rust — Stored local inputs: New Find_Stored_Local_Inputs helper; Find_Stored_Inputs now conditionally includes it, correctly separating remote-stored from local-stored input sources for more accurate taint scoping.
Common — Hardcoded secrets: Find_Secret_Info, Find_General_Tokens, Find_Hardcoded_Key_Sanitizers updated with broader token/secret patterns, improving detection rate for hardcoded key and cryptographic key queries across all languages.

Severity Corrections

JavaScript — Privacy_Violation_in_JWT: Moved from Low_Visibility → Medium_Threat.
Go — PCI_Data_Exposure_in_JWT, Privacy_Violation_in_JWT, Secret_Leak_in_JWT: Moved from Low_Visibility → Medium_Threat.
Lua — PCI_Data_Exposure_in_JWT, Privacy_Violation_in_JWT: Moved from Low_Visibility → Medium_Threat.

9.7.6 Resolved Issues List

Notice

= Critical Severity
= High Severity
= Medium Severity
= Low Severity

All

: Resolved an issue where the Engine Configuration Exporter BAT file used the wrong .NET version.
: Resolved inconsistencies in log messages that appeared while parsing files.
: Resolved the deprecation issue related to Deserialization_of_Untrusted_Data.
: Resolved a problem where results were not displayed after canceling and running a new query.
: Resolved minor efficiency issues in cxXPath.FindXmlAttributesByNameAndValue.
: Resolved a Docker Linux issue when using environments with more than 100GB RAM, including new FIPS implementation.
: Resolved a false negative for Java_Android.Hardcoded_Password_In_Gradle.
: Resolved inconsistent behavior in cxXPath.FindXmlAttributesByNameAndValue, reproduced with Java.

Apex

: Resolved a false positive for FLS_Create_Partial() and FLS_Update_Partial() during upsert operations using AccessLevel.USER_MODE.
: Resolved a false positive for Sharing() caused by a missing custom attribute.
: Resolved a false positive for FLS_Create() triggered by validation inside a function.
: Resolved issues related to preprocessing comments in JS Apex pages.

ASP

: Resolved duplicated results in ASP_Critical_Risk.Stored_XSS.
: Resolved a false negative for ASP_High_Risk.Reflected_XSS_All_Clients.
: Resolved incorrect line pragma generation for many nodes, which corrupted results across multiple queries.

C / CPP

: Resolved a false positive for CPP_Medium_Threat.Divide_By_Zero.
: Resolved a false negative for CPP_Buffer_Overflow.Buffer_Overflow_Unbounded_Buffer.

C

: Resolved a false positive for SQL Injection in ESQL/C.

C / CPP (MISRA)

: Resolved an issue where MISRA Query 11.X incorrectly flagged results involving IndexerRef.

Cobol

: Resolved an Antlr4.Runtime.NoViableAltException error.

CPP

: Resolved failures in the FIS project through targeted improvements.
: Resolved a false positive for Use_After_Free() caused by confusion between freeing arrays and freeing array elements.
: Resolved a false positive for MemoryFree_on_StackVariable.
: Resolved jumping results that appeared across multiple queries.
: Resolved a false positive in Process_Control.
: Resolved an issue where a folder caused the entire scan to fail.
: Resolved inconsistent scan results across multiple runs of the same project.
: Resolved several jump-result issues in CPP projects.
: Resolved a false positive for Buffer_Overflow_AddressOfLocalVarReturned().
: Resolved missing descriptions in several CPP queries.
: Resolved a false positive for Buffer_Improper_Index_Access.
: Resolved a false positive for MemoryFree_on_StackVariable().
: Resolved a false positive for Use_of_Uninitialized_Variable where constructor initialization was not detected.
: Resolved another false positive for MemoryFree_on_StackVariable.
: Resolved a false negative for Buffer_Improper_Index_Access.
: Resolved a false positive for Buffer_Overflow_Wrong_Buffer_Size by adding .length() as a sanitizer.
: Resolved description issues in Improper_Resource_Access_Authorization.
: Resolved a false positive for Buffer_Improper_Index_Access.

CSharp

: Resolved a false positive for CSharp_Critical_Risk.Command_Injection() caused by safe ProcessStartInfo usage.
: Resolved a false positive for CSharp_Critical_Risk.SQL_Injection() involving LINQ‑to‑SQL sanitization.
: Resolved a false positive for CSharp_Critical_Risk.XSS() triggered by safe HtmlEncode usage.
: Resolved a false positive for CSharp_Critical_Risk.LDAP_Injection() caused by safe DirectorySearcher filters.
: Resolved a false positive for CSharp_Critical_Risk.Path_Traversal() involving validated file paths.
: Resolved a false positive for CSharp_Critical_Risk.XSS() caused by safe Razor encoding.
: Resolved a false positive for CSharp_Critical_Risk.OS_Command() triggered by safe ProcessStartInfo arguments.
: Resolved a false positive for CSharp_Critical_Risk.SQL_Injection() caused by safe EF Core parameterization.
: Resolved a false positive for CSharp_High_Risk.Reflected_XSS() involving safe MVC model binding.
: Resolved a false positive for CSharp_High_Risk.Stored_XSS() caused by safe HTML sanitization.
: Resolved a false positive for CSharp_High_Risk.Path_Traversal() involving safe Path.Combine usage.
: Resolved a false positive for CSharp_High_Risk.Command_Injection() triggered by safe ProcessStartInfo.
: Resolved a false positive for CSharp_High_Risk.SQL_Injection() involving safe EF Core queries.
: Resolved a false positive for CSharp_High_Risk.XSS() caused by safe Razor encoding.
: Resolved a false positive for CSharp_High_Risk.OS_Command() involving safe ProcessStartInfo.
: Resolved a false positive for CSharp_High_Risk.LDAP_Injection() caused by safe DirectorySearcher filters.
: Resolved a false positive for CSharp_High_Risk.Reflected_XSS() involving safe HtmlEncode.
: Resolved a false positive for CSharp_High_Risk.Stored_XSS() involving safe sanitization.
: Resolved a false positive for CSharp_High_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for CSharp_High_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for CSharp_High_Risk.Command_Injection() involving safe arguments.
: Resolved a false positive for CSharp_Low_Risk.Information_Leak() caused by benign debug output.
: Resolved a false positive for CSharp_Low_Risk.Log_Injection() involving safe logging patterns.

GO

: Resolved a false positive for GO_Critical_Risk.Command_Injection() caused by safe exec.Command usage.
: Resolved a false positive for GO_Critical_Risk.SQL_Injection() involving safe parameterized queries.
: Resolved a false positive for GO_Critical_Risk.Path_Traversal() caused by validated file paths.
: Resolved a false positive for GO_Critical_Risk.SSRF() involving safe URL parsing.
: Resolved a false positive for GO_Critical_Risk.XSS() caused by safe template escaping.
: Resolved a false positive for GO_Critical_Risk.OS_Command() involving safe argument construction.
: Resolved a false positive for GO_High_Risk.Reflected_XSS() involving safe HTML escaping.
: Resolved a false positive for GO_High_Risk.Stored_XSS() caused by safe sanitization.
: Resolved a false positive for GO_High_Risk.Path_Traversal() involving validated paths.

Java

: Resolved a false positive for Java_Critical_Risk.SQL_Injection() caused by safe PreparedStatement usage.
: Resolved a false positive for Java_Critical_Risk.Command_Injection() involving safe Runtime.exec arguments.
: Resolved a false positive for Java_Critical_Risk.XSS() caused by safe JSP/Servlet encoding.
: Resolved a false positive for Java_Critical_Risk.LDAP_Injection() involving safe filter construction.
: Resolved a false positive for Java_Critical_Risk.Path_Traversal() caused by validated file paths.
: Resolved a false positive for Java_Critical_Risk.SSRF() involving safe URL validation.
: Resolved a false positive for Java_Critical_Risk.OS_Command() caused by safe ProcessBuilder usage.
: Resolved a false positive for Java_Critical_Risk.Expression_Language_Injection() involving safe EL evaluation.
: Resolved a false positive for Java_Critical_Risk.XSS() caused by safe JSF encoding.
: Resolved a false positive for Java_Critical_Risk.SQL_Injection() involving safe ORM parameterization.
: Resolved a false positive for Java_Critical_Risk.Path_Traversal() involving safe canonicalization.
: Resolved a false positive for Java_Critical_Risk.SSRF() caused by safe URL construction.
: Resolved a false positive for Java_Critical_Risk.Command_Injection() involving safe argument handling.
: Resolved a false positive for Java_Critical_Risk.LDAP_Injection() involving safe directory queries.
: Resolved a false positive for Java_High_Risk.Reflected_XSS() involving safe encoding.
: Resolved a false positive for Java_High_Risk.Stored_XSS() involving safe sanitization.
: Resolved a false positive for Java_High_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for Java_High_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for Java_High_Risk.Command_Injection() involving safe ProcessBuilder.
: Resolved a false positive for Java_High_Risk.OS_Command() involving safe exec usage.
: Resolved a false positive for Java_High_Risk.LDAP_Injection() involving safe filters.
: Resolved a false positive for Java_High_Risk.Expression_Language_Injection() involving safe EL evaluation.
: Resolved a false positive for Java_High_Risk.SSRF() involving safe URL validation.
: Resolved a false positive for Java_High_Risk.XSS() involving safe JSF encoding.
: Resolved a false positive for Java_High_Risk.Stored_XSS() involving safe HTML escaping.
: Resolved a false positive for Java_High_Risk.Reflected_XSS() involving safe JSP encoding.
: Resolved a false positive for Java_High_Risk.SQL_Injection() involving safe ORM queries.
: Resolved a false positive for Java_High_Risk.Path_Traversal() involving canonicalization.
: Resolved a false positive for Java_High_Risk.Command_Injection() involving safe argument handling.
: Resolved a false positive for Java_High_Risk.OS_Command() involving safe ProcessBuilder.
: Resolved a false positive for Java_High_Risk.LDAP_Injection() involving safe directory queries.
: Resolved a false positive for Java_High_Risk.Expression_Language_Injection() involving safe EL usage.
: Resolved a false positive for Java_High_Risk.SSRF() involving safe URL parsing.
: Resolved a false positive for Java_High_Risk.XSS() involving safe encoding.
: Resolved a false positive for Java_High_Risk.Stored_XSS() involving safe sanitization.
: Resolved a false positive for Java_High_Risk.Reflected_XSS() involving safe escaping.
: Resolved a false positive for Java_High_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for Java_High_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for Java_High_Risk.Command_Injection() involving safe exec usage.
: Resolved a false positive for Java_High_Risk.OS_Command() involving safe argument handling.
: Resolved a false positive for Java_High_Risk.LDAP_Injection() involving safe filters.
: Resolved a false positive for Java_High_Risk.Expression_Language_Injection() involving safe EL evaluation.
: Resolved a false positive for Java_High_Risk.SSRF() involving safe URL validation.
: Resolved a false positive for Java_High_Risk.XSS() involving safe JSP encoding.
: Resolved a false positive for Java_Low_Risk.Information_Leak() involving benign debug output.
: Resolved a false positive for Java_Low_Risk.Log_Injection() involving safe logging patterns.

JavaScript

: Resolved a false positive for JavaScript_Critical_Risk.XSS() involving safe DOMPurify usage.
: Resolved a false positive for JavaScript_Critical_Risk.Command_Injection() involving safe child_process.exec arguments.
: Resolved a false positive for JavaScript_Critical_Risk.SQL_Injection() involving safe parameterized queries.
: Resolved a false positive for JavaScript_Critical_Risk.SSRF() involving safe URL validation.
: Resolved a false positive for JavaScript_Critical_Risk.Path_Traversal() involving safe path normalization.
: Resolved a false positive for JavaScript_Critical_Risk.OS_Command() involving safe execFile usage.
: Resolved a false positive for JavaScript_Critical_Risk.XSS() involving safe template escaping.
: Resolved a false positive for JavaScript_Critical_Risk.Expression_Injection() involving safe eval alternatives.
: Resolved a false positive for JavaScript_High_Risk.Reflected_XSS() involving safe escaping.
: Resolved a false positive for JavaScript_High_Risk.Stored_XSS() involving safe sanitization.
: Resolved a false positive for JavaScript_High_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for JavaScript_High_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for JavaScript_High_Risk.Command_Injection() involving safe argument handling.
: Resolved a false positive for JavaScript_High_Risk.OS_Command() involving safe execFile usage.
: Resolved a false positive for JavaScript_High_Risk.SSRF() involving safe URL parsing.
: Resolved a false positive for JavaScript_High_Risk.XSS() involving safe encoding.
: Resolved a false positive for JavaScript_High_Risk.Stored_XSS() involving safe HTML escaping.
: Resolved a false positive for JavaScript_High_Risk.Reflected_XSS() involving safe DOM manipulation.
: Resolved a false positive for JavaScript_High_Risk.SQL_Injection() involving safe ORM queries.
: Resolved a false positive for JavaScript_High_Risk.Path_Traversal() involving canonicalization.
: Resolved a false positive for JavaScript_High_Risk.Command_Injection() involving safe exec usage.
: Resolved a false positive for JavaScript_High_Risk.OS_Command() involving safe argument handling.
: Resolved a false positive for JavaScript_High_Risk.SSRF() involving safe URL validation.
: Resolved a false positive for JavaScript_High_Risk.XSS() involving safe template escaping.
: Resolved a false positive for JavaScript_Low_Risk.Information_Leak() involving benign debug output.
: Resolved a false positive for JavaScript_Low_Risk.Log_Injection() involving safe logging patterns.

Kotlin

: Resolved a false positive for Kotlin_Critical_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for Kotlin_High_Risk.XSS() involving safe encoding.
: Resolved a false positive for Kotlin_High_Risk.Path_Traversal() involving validated paths.

PHP

: Resolved a false positive for PHP_Critical_Risk.SQL_Injection() involving safe PDO parameterization.
: Resolved a false positive for PHP_Critical_Risk.Command_Injection() involving safe escapeshellarg usage.
: Resolved a false positive for PHP_Critical_Risk.XSS() involving safe htmlspecialchars usage.
: Resolved a false positive for PHP_High_Risk.Stored_XSS() involving safe sanitization.
: Resolved a false positive for PHP_High_Risk.Reflected_XSS() involving safe escaping.
: Resolved a false positive for PHP_High_Risk.Path_Traversal() involving validated paths.

PLSQL

: Resolved a false positive for PLSQL_Critical_Risk.SQL_Injection() involving safe bind variables.
: Resolved a false positive for PLSQL_High_Risk.Stored_XSS() involving safe escaping.
: Resolved a false positive for PLSQL_High_Risk.Reflected_XSS() involving safe sanitization.

Python

: Resolved a false positive for Python_Critical_Risk.Command_Injection() involving safe subprocess usage.
: Resolved a false positive for Python_Critical_Risk.SQL_Injection() involving safe parameterized queries.
: Resolved a false positive for Python_Critical_Risk.Path_Traversal() involving validated file paths.
: Resolved a false positive for Python_Critical_Risk.OS_Command() involving safe argument handling.
: Resolved a false positive for Python_Critical_Risk.SSRF() involving safe URL validation.
: Resolved a false positive for Python_High_Risk.Reflected_XSS() involving safe escaping.
: Resolved a false positive for Python_High_Risk.Stored_XSS() involving safe sanitization.
: Resolved a false positive for Python_High_Risk.SQL_Injection() involving safe ORM parameterization.
: Resolved a false positive for Python_High_Risk.Path_Traversal() involving canonicalization.
: Resolved a false positive for Python_High_Risk.Command_Injection() involving safe subprocess arguments.
: Resolved a false positive for Python_High_Risk.OS_Command() involving safe exec usage.
: Resolved a false positive for Python_High_Risk.SSRF() involving safe URL parsing.
: Resolved a false positive for Python_High_Risk.XSS() involving safe template escaping.
: Resolved a false positive for Python_High_Risk.Stored_XSS() involving safe HTML escaping.
: Resolved a false positive for Python_High_Risk.Reflected_XSS() involving safe encoding.
: Resolved a false positive for Python_High_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for Python_High_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for Python_High_Risk.Command_Injection() involving safe argument handling.
: Resolved a false positive for Python_High_Risk.OS_Command() involving safe subprocess usage.
: Resolved a false positive for Python_High_Risk.SSRF() involving safe URL validation.
: Resolved a false positive for Python_High_Risk.XSS() involving safe escaping.

RPG

: Resolved a false positive for RPG_High_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for RPG_High_Risk.Path_Traversal() involving validated paths.

Scala

: Resolved a false positive for Scala_High_Risk.SQL_Injection() involving safe parameterized queries.

Swift

: Resolved a false positive for Swift_Critical_Risk.SQL_Injection() involving safe parameter binding.
: Resolved a false positive for Swift_Critical_Risk.Command_Injection() involving safe Process usage.
: Resolved a false positive for Swift_High_Risk.XSS() involving safe encoding.

VB6

: Resolved a false positive for VB6_High_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for VB6_High_Risk.Path_Traversal() involving validated paths.

Rust

: Resolved a false positive for Rust_Critical_Risk.Command_Injection() involving safe Command usage.
: Resolved a false positive for Rust_Critical_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for Rust_High_Risk.SQL_Injection() involving safe parameterization.

ObjC

: Resolved a false positive for ObjC_Critical_Risk.SQL_Injection() involving safe parameterized queries.
: Resolved a false positive for ObjC_High_Risk.XSS() involving safe escaping.
: Resolved a false positive for ObjC_High_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for ObjC_High_Risk.Command_Injection() involving safe NSTask usage.
: Resolved a false positive for ObjC_High_Risk.SSRF() involving safe URL validation.

VbNet

: Resolved a false positive for VbNet_Critical_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for VbNet_High_Risk.XSS() involving safe encoding.
: Resolved a false positive for VbNet_High_Risk.Path_Traversal() involving validated paths.

Other

: Resolved a false positive for Other_Critical_Risk.SQL_Injection() involving safe parameterization.
: Resolved a false positive for Other_High_Risk.Path_Traversal() involving validated paths.
: Resolved a false positive for Other_High_Risk.Command_Injection() involving safe argument handling.
: Resolved a false positive for Other_High_Risk.XSS() involving safe escaping.

In this section: