Newest papers

What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software

Mahzabin Tamanna, S M Jamil Uddin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25774 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

A indústria de avaliação de vulnerabilidade compartilhada encontra-se cada vez mais dependente de software construído a partir de componentes de terceiros, mas a composição de dependência e a exposição de vulnerabilidade conhecida de software relacionado à construção permanecem mal analisadas. Neste estudo, realizamos uma investigação empírica e ecossistema-cross-exposição de 904 repositórios GitHub relacionados à construção que abrangem seis funções de construção e uma categoria multifuncional. Usando snapshots de repositório com compromisso e OSV-Scanner de segurança, examinamos a avaliação de dependência, a prevalência de vulnerabilidade conhecida, a gravidade, as classificações de fraqueza e a exposição compartilhada. Nossos resultados revelam que apenas 494 repositórios (54,6%) completaram a avaliação de vulnerabilidade,

Machine translation (Meta M2M100); the English original follows.

Abstract

The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Dependency (UML), Vulnerability (computing), Upstream (networking), Software deployment, Baseline (sea), Computer science

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange