Newest papers

What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software

Mahzabin Tamanna, S M Jamil Uddin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25774 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

建設業界の共用性評価ファミリーは、ますます第三者コンポーネントから構築されたソフトウェアに依存しているが、建設関連ソフトウェアの依存性構成および既知の脆弱性曝露はまだ不十分に分析されている。この研究では、我々は、6つの建設機能および多機能カテゴリをカバーする904の建設関連のGitHubレポーターの実験的、エコシステム上の調査を実施している。コミット・ピンナード・レポーター・スナップショットとOSV-スキャナーを使用して、我々は依存性評価、既知の脆弱性の普及、重度、脆弱性分類、および共用アップストリームの調査を実施している。我々の結果は、494のレポー

Machine translation (Meta M2M100); the English original follows.

Abstract

The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Dependency (UML), Vulnerability (computing), Upstream (networking), Software deployment, Baseline (sea), Computer science

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange