Runtimes
Last updated: Oct 26, 2026
Runtime CVE detection is different from package manager dependency scanning. Dependency scanning reports a vulnerability in a declared dependency of your project. Runtime CVE detection reports a vulnerability in the language or runtime, for example, a CVE in the Go toolchain or in the Ruby interpreter. Because of this difference, only a small number of the ecosystems that Fluid Attacks scans for dependencies also get runtime CVE reports.
The criterion
To report a runtime CVE safely, Fluid Attacks must have proof that the detected version is the version that runs in production. A version that the manifest of the project identifies as compatible is not sufficient. Most manifest fields declare only compatibility, which is a range of versions that the code must work with. These fields do not show the version that you deploy. If Fluid Attacks used them as a runtime CVE signal, it could report vulnerabilities that possibly do not apply.
At this time, only two cases give this proof:
- Go: Go compiles to a static binary that contains its own runtime. The
build puts the Go version from
go.modinto the artifact. Thus, this version is a real deployment fact, not a guess. - Ruby on Heroku: The Heroku buildpack reads the
rubydirective of the Gemfile at build time and installs the version that the directive shows. This is true only in the Heroku build flow. Thus, Fluid Attacks reports Ruby runtime CVEs only if the repository has aProcfile. This file shows that the project deploys on Heroku. Without aProcfile, the directive is only a compatibility declaration, as in all other ecosystems in the table that follows.
Runtime CVE support by ecosystem
| Language / ecosystem | Manifest field | Runtime CVE detection | Why |
|---|---|---|---|
| Go | go.mod Go version directive | Supported | Static binary contains its own runtime. This is a deployment fact |
| Ruby (Bundler, on Heroku) | Gemfile/Gemfile.lock ruby directive | Supported, if a Procfile is present | Heroku's buildpack installs the version of the directive at build time |
| Ruby (Bundler, no Heroku) | Gemfile/Gemfile.lock ruby directive | Not applicable | Compatibility-only declaration without a Heroku deployment signal |
| Ruby (RubyGems) | *.gemspec required_ruby_version | Not applicable | A gem's declared compatibility targets its own consumers, not an application's deployment |
| .NET / NuGet | *.csproj TargetFramework | Not applicable | Compatibility-only declaration. A framework-dependent deployment can use a different installed runtime |
| Node.js / npm, Bun | package.json engines.node / engines.bun | Not applicable | Compatibility-only declaration, same problem as .NET |
| Python (Poetry, Pipenv, uv) | requires-python and equivalents | Not applicable | Compatibility-only declaration, same problem as .NET |
| Swift (SPM) | Package.swift swift-tools-version | Not applicable | Compatibility-only declaration, same problem as .NET |
| Dart / Flutter (pub) | pubspec.yaml environment.sdk | Not applicable | Compatibility-only declaration, same problem as .NET |
| PHP (Composer) | composer.json require.php | Not applicable | Compatibility-only declaration, same problem as .NET |
| Yarn, pnpm | N/A | Not applicable | Lockfile formats have no runtime version field |
| Pip | N/A | Not applicable | requirements.txt has no Python version field |
| CocoaPods | N/A | Not applicable | No standardized Swift/Objective-C runtime version field in the format |
| Gradle, Maven, sbt | N/A | Not available | Scoped and prototyped, but not merged to trunk. No runtime detection at this time |
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, complete this contact form.