Searcharxiv⌕ Search
Home/Archive/arXiv

arXiv · 2610.25774

What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software

Mahzabin Tamanna·S M Jamil Uddin
View original source ↗Read source document ↗Export metadata ↓

Abstract

The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.

Explore related subjects

cs.SE

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Mahzabin Tamanna, S M Jamil Uddin. 2026-10-19. What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software. https://arxiv.org/abs/2610.25774

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Mitigating Risks in Software Development through Effective Requirements Engineering

Problems that originate in requirements are common and expensive in software projects, and they are a recurring cause of late delivery, budget overruns and cancellation. This paper is a narrative overview of requirements engineering (RE) as a means of reducing these risks. It outlines the core RE activities (elicitation, analysis and negotiation, specification, validation and change management) and the kinds of statements a requirements document contains, including the distinction between requirements, domain properties, assumptions and definitions. It reviews the evidence on the cost of requirements defects, together with the main criticisms of that evidence, and compares how the waterfall, spiral, iterative (Rational Unified Process) and agile lifecycles treat requirements. It then discusses stakeholder identification, elicitation techniques and common obstacles to elicitation, and describes practical ways of turning vague or conflicting stakeholder statements, including security and performance expectations, into precise, verifiable and prioritized requirements. The paper is intended as an introduction for practitioners and students who work with requirements but are not RE specialists.

cs.SE↗
arXiv2026

WAFFLE: Finetuning Multi-Modal Models for Automated Front-End Development

Web development involves turning UI designs into functional webpages, which can be difficult for both beginners and experienced developers due to the complexity of HTML's hierarchical structures and styles. While Large Language Models (LLMs) have shown promise in generating source code, two major challenges persist in UI-to-HTML code generation: (1) effectively representing HTML's hierarchical structure for LLMs, and (2) bridging the gap between the visual nature of UI designs and the text-based format of HTML code. To tackle these challenges, we introduce Waffle, a new fine-tuning strategy that uses a structure-aware attention mechanism to improve LLMs' understanding of HTML's structure and a contrastive fine-tuning approach to align LLMs' understanding of UI images and HTML code. Models fine-tuned with Waffle show up to 9.00 pp (percentage point) higher HTML match, 0.0982 higher CW-SSIM, 32.99 higher CLIP, and 27.12 pp higher LLEM on our new benchmark WebSight-Test and an existing benchmark Design2Code, outperforming current fine-tuning methods.

cs.SE↗
arXiv2026

Can Language Models Replace Programmers for Coding? REPOCOD Says 'Not Yet'

Recently, a number of repository-level code generation benchmarks-such as CoderEval, DevEval, RepoEval, RepoBench, and LongCodeArena-have emerged to evaluate the capabilities of large language models (LLMs) beyond standalone benchmarks like HumanEval and MBPP. Thus, a natural question is, would LLMs have similar performance in real world coding tasks as their performance in these benchmarks? Unfortunately, one cannot answer this question, since these benchmarks consist of short completions, synthetic examples, or focus on limited scale repositories, failing to represent real-world coding tasks. To address these challenges, we create REPOCOD, a Python code-generation benchmark containing complex tasks with realistic dependencies in real-world large projects and appropriate metrics for evaluating source code. It includes 980 whole-function generation tasks from 11 popular projects, 50.8% of which require repository-level context. REPOCOD includes 314 developer-written test cases per instance for better evaluation. We evaluate ten LLMs on REPOCOD and find that none achieves more than 30% pass@1 on REPOCOD, indicating the necessity of building stronger LLMs that can help developers in real-world software development. In addition, we found that retrieval-augmented generation achieves better results than using target function dependencies as context.

cs.SE↗