Newest papers

What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software

Mahzabin Tamanna, S M Jamil Uddin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25774 · cited by 0 works (OpenAlex) · open-access PDF

Indonesian

Dalam penelitian ini, kami melakukan survei empiris, survei lintas-ekosistem dari 904 repositori GitHub yang terkait dengan konstruksi yang mencakup enam fungsi konstruksi dan kategori multifungsi. Menggunakan snapshots repository komisi-pinned dan OSV-Scanner keamanan, kami memeriksa evaluasi ketergantungan, prevalensi interpretasi-ketergantungan yang diketahui, keparahan, klasifikasi kelemahan, dan eksposur upstream bersama. Hasil kami mengungkapkan bahwa hanya 494 repositori (54,6%) menyelesaikan penilaian kerentanan, mengungkapkan kesenjangan yang signifikan dalam ketergantungan. Di antara repository yang berhasil dipantau, 395 (80.0%) kami berisi setidaknya satu versi penilaian ketergantungan yang dikenal terkait dengan kerentanan yang diterbitkan, dan 97.2% dari

Machine translation (Meta M2M100); the English original follows.

Abstract

The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Dependency (UML), Vulnerability (computing), Upstream (networking), Software deployment, Baseline (sea), Computer science

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange