Newest papers

What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software

Mahzabin Tamanna, S M Jamil Uddin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25774 · cited by 0 works (OpenAlex) · open-access PDF

German

In dieser Studie führen wir eine empirische, ökosystemübergreifende Untersuchung von 904 baulichen GitHub-Repositories, die sich auf sechs Baufunktionen und eine Multifunktionskategorie erstrecken, durch, dass nur 494 Repositories (54,6%) die Bewertung der Schwachstellen abgeschlossen haben, was erhebliche Lücken in der Sichtbarkeit aufzeigt. Unter den erfolgreich gescannten Repositories haben wir 395 (80.0%) ihrer bekannten Interpretationsverbreitung, Schwere, Schwachstellenklassifizierungen und geteilte Exposition enthalten. Unsere Ergebnisse zeigten, dass nur 494 Repositories (54,6%) die Bewertung der Schwachstellen abgeschlossen haben, was erhebliche Lücken in der Abhängigkeit ergab. Unter den erfolgreich gesc

Machine translation (Meta M2M100); the English original follows.

Abstract

The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Dependency (UML), Vulnerability (computing), Upstream (networking), Software deployment, Baseline (sea), Computer science

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange