CWE-1101, Reliance on Runtime Component in Generated Code, describes a product that uses automatically generated code that cannot be executed without a specific runtime support component.
MITRE marks it as a quality issue with no direct security implications and prohibits it for mapping real vulnerabilities.
How it happens
Code generators, such as parser generators, interface compilers and object mappers, often emit code that calls into a support library. The generated files look self contained, but they will not run without that library, usually at a specific version.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability, and indirectly harder and slower discovery and repair of vulnerabilities. The security angle is a dependency one: a runtime component that is not tracked can carry a known vulnerability, and generated code that is pinned to an old version makes upgrading painful.
How to find it
The record lists no detection methods. Look for generated sources in your repository and check which library they import. Then check that library appears in your dependency inventory and in your software bill of materials.
How to fix it
- Record the generator and its runtime in the build files, with versions.
- Regenerate code when you upgrade the runtime, as part of the build and not by hand.
- Keep generated files out of manual edits.
- Include runtime components in dependency and vulnerability scanning.
Quick check
Why track the runtime behind generated code?
It is a real dependency. If it has a known flaw, your product is affected even though you never wrote that code.
