Engine Pack Version 9.7.7
CxSAST Engine
Languages & Frameworks
All supported code Languages & Frameworks versions can be found here.
Python
Updated Parsing Capabilities
Extended Python parsing support to cover language features introduced in Python 3.12, 3.13, and 3.14.
FastAPI
Added support for the FastAPI (4.0.0) framework in Python.
SQLAlchemy
Updated SQLAlchemy support from the legacy version 0.9 to the latest 2.0+ releases
NoSQL MongoDB Injection Detection
Introduced new queries for detecting NoSQL Injection and NoSQL Second Order Injection in Python applications using MongoDB.
JavaScript
Added support for import aliases defined in babel.config.js. Previously, only webpack.config.js aliases were resolved.
CSharp & .NET
Updated SAST engine support to cover .NET 10 and C# 14, including new APIs and language features introduced between .NET 8–10 and C# 12–14.
SQL Unified Language
PLSQL is now integrated into the Unified SQL language alongside T-SQL. Existing PLSQL queries have been reviewed and merged into the SQL Unified framework, enabling shared queries across dialects and eliminating duplicate results for customers with SQL Unified enabled.
Compliance Standards
All & Mobile Presets
Mobile queries will be removed from All preset in Engine Pack 9.8.1
List of queries to be removed: Mobile queries to be removed from preset ALL
OWASP Top 10 for LLM Applications
Added a new preset and compliance category for the OWASP Top 10 for Large Language Model Applications (2025 edition). Coverage includes LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure), LLM03 (Supply Chain), LLM05 (Improper Output Handling), and LLM06 (Excessive Agency), across Java, JavaScript/TypeScript, C#, Python, and Go. Key LLM libraries from OpenAI, Anthropic, Azure, Google, and HuggingFace are supported.
List of Libraries
The combination of all SDKs, libraries and tools for each language, referenced in different queries:
Java
com.google.genai.Client
Generic HTTP Clients:
okHttp for all LLMs (Claude, ChatGPT, Copilot, Gemini)
defaultHttpClient for ChatGPT and Copilot
Note: com.google.cloud.vertexai.generativeai is deprecated, moved on to genai.
JS/TS
@google/genai
Generic HTTP Clients:
https, node-fetch, Axios for all LLMs (Claude, ChatGPT, Copilot, Gemini)
vaniila fetch / xhr for ChatGPT
JQuery for Claude,ChatGPT and Copilot
C#/.net
Generic HTTP Clients:
httpClient for all LLMs (Claude, ChatGPT, Copilot, Gemini)
Note: https://github.com/anthropics/anthropic-sdk-csharp is in beta. There's no production-ready version available.
Python
google.genai
huggingface_hub, pyTorch, marshal,tf-Keras,fastai,bertopic
Generic HTTP Clients:
Claude:
Requests
http.client
ChatGPT:
requests
Copilot:
http.client
requests
Gemini:
http.client
requests
Go
@google/genai
Generic HTTP Clients:
net/http for all LLMs (Claude, ChatGPT, Copilot, Gemini)