Newest papers

What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software

Mahzabin Tamanna, S M Jamil Uddin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25774 · cited by 0 works (OpenAlex) · open-access PDF

Hindi

संरचनात्मक संदर्भ का आकलन करने वाले परिवारों को तीसरे पक्ष के घटकों से बना हुआ सॉफ्टवेयर पर अधिक से अधिक भरोसा होता है, फिर भी संरचनात्मक संदर्भ का आकलन और संरचनात्मक सॉफ्टवेयर से संबंधित सॉफ्टवेयर के ज्ञात कमजोरता के संपर्क को कम रूप से विश्लेषण किया जाता है। इस अध्ययन में, हम 904 संरचनात्मक संबंधित GitHub रजिस्ट्रेशनों के एक अनुभवकीय, पारस्परिक पारस्परिक सर्वेक्षण का संचालन करते हैं जो छह संरचनात्मक कार्यों और एक मल्टीफंक्शन श्रेणी को कवर करते हैं। कमिट-पिनिंग रजिस्ट्रेशन स्नैपशॉट्स और OSV-स्कैनर का उपयोग करके, हमने निर्भरता की आकलन, ज्ञात कमजोरता की उपस्थिति, गंभीरता

Machine translation (Meta M2M100); the English original follows.

Abstract

The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Dependency (UML), Vulnerability (computing), Upstream (networking), Software deployment, Baseline (sea), Computer science

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange