Value of enriching sparse CLI-SAST findings with CWE/CVE data

Determine whether retrieving information from Common Weakness Enumeration and Common Vulnerabilities and Exposures databases provides valuable additional detail for issues generated from command-line-only SAST tools that report little beyond a CWE or CVE reference.

Background

The proposed integration process primarily focuses on GUI-based SAST tools with APIs, whereas many command-line-only tools lack APIs and provide limited descriptions of detected issues. The paper identifies incorporation of such tools as a planned extension of the process.

Because sparse CLI-tool output may contain only a CWE or CVE reference, the authors leave unresolved whether querying the corresponding CWE/CVE databases would meaningfully improve the information presented to developers in issue-tracking systems.

References

Some of these CLI tools provide little to no detail on the issues they uncover, except for a reference to their corresponding CWE or CVE. We will investigate whether retrieving data from the CWE/CVE databases to fill out more information in these issues would be valuable.

— Automating Static Code Analysis Through CI/CD Pipeline Integration  (2609.00676 - Wadhams et al., 1 Sep 2026) in Section 7, Conclusion and Future Work