Common Weakness Enumeration (CWE)
: A community-developed catalog of software and hardware weakness types. Each CWE entry describes a category of vulnerability (not a specific instance) with its characteristics, potential consequences, and mitigations. CWE provides a common language for describing security weaknesses, used by SAST tools, OWASP, and vulnerability databases.
Why It Matters for AI-Coded Apps
Understanding CWE categories helps developers recognize patterns in AI-generated code. When you know that CWE-89 (SQL Injection) appears frequently in AI output, you can specifically review all database queries. CWE categories map directly to the systematic weaknesses LLMs produce, making them a practical framework for AI code review.
Real-World Example
SAST scan results reference CWE-79 (XSS) and CWE-89 (SQL Injection). Looking up these CWEs provides: detailed description of the weakness, code examples, detection methods, and prevention guidance. This structured information helps developers fix issues correctly rather than applying superficial patches.
How to Detect and Prevent It
Learn the CWE Top 25 most dangerous weaknesses. Use SAST tools that report CWE identifiers for findings. Map your application’s security requirements to relevant CWE categories. Train your team on CWEs most common in AI-generated code: CWE-79 (XSS), CWE-89 (SQL Injection), CWE-862 (Missing Authorization), CWE-798 (Hardcoded Credentials).
Frequently Asked Questions
What is the difference between CWE and CVE?
CWE describes types of weaknesses (e.g., CWE-89: SQL Injection as a category). CVE identifies specific vulnerability instances (e.g., CVE-2024-12345: SQL injection in Product X version 1.2). CWE is the taxonomy; CVE is the catalog of specific findings. A CVE typically references one or more CWEs.
What are the most common CWEs in AI-generated code?
Based on our research: CWE-79 (XSS) appears in 61% of apps, CWE-862 (Missing Authorization) in 58%, CWE-798 (Hardcoded Credentials) in 45%, CWE-89 (SQL Injection) in 32%, CWE-352 (CSRF) in 28%, and CWE-22 (Path Traversal) in 15% of vibe-coded applications.
How does OWASP relate to CWE?
The OWASP Top 10 maps directly to CWE categories. For example, OWASP A03:2021 (Injection) maps to CWE-79, CWE-89, CWE-78, and related injection CWEs. OWASP provides the high-level risk categories; CWE provides the detailed technical taxonomy used by tools and databases.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval