GitHub activity reveals popular software security flaws to fix first
GitHub Engagement Signals for CVE Prioritization: The GitHub Popularity Metric (GPM)
Cryptography and Security
Summary
Fixing software security problems quickly is hard because there are many to choose from and patches take time. The authors created a new way to figure out which security flaws are more popular by looking at how often they appear and get attention on GitHub, a website where developers share code. This new measure helps defenders spot important vulnerabilities that others might miss and works alongside existing systems. They tested and included it in a known vulnerability scoring system to help prioritize fixes more effectively.
What this means in practice
- •For security operations teams: Improve the order of vulnerability fixes by incorporating GitHub activity signals to better capture real-world exploit popularity.
- •For software development teams: Use GitHub-based metrics to monitor emerging exploit trends and prioritize security patches accordingly in development cycles.
Authors
Jafar Akhoundali, Kristian Rietveld, Olga Gadyatskaya
Abstract
Attackers can compromise multiple systems with a single vulnerability, while defenders need to fix all security weaknesses in their systems. This asymmetry puts defenders at a disadvantage. Security vulnerabilities are found at an alarming rate, and patching vulnerabilities is costly and time-consuming; thus, vulnerability prioritization is a must and a time-critical challenge. Many prioritization metrics, such as the CVSS, EPSS, KEV, and SSVC, are currently used, each with different pros and cons, such as openness, degree of automation, time-criticality, coverage, and need for expert input. In this work, we propose the GitHub Popularity Metric (GPM), a fully open, publicly computable prioritization metric based on the popularity of exploits in GitHub repositories. We use GitHub features such as the number of stars, forks, and related unique users to create a metric that indicates the popularity of CVEs across different time frames, both relative to the current time and historically. We compare the proposed metric with various existing vulnerability prioritization metrics and known exploited vulnerabilities and demonstrate that it provides tangible insights for defenders, identifying unique CVEs and inconsistencies in existing methods. The GPM was integrated into the EPSS version 5. \noindent\textbf{Note.} A demonstration based on this work has been accepted to the demo track of the ACM Conference on Computer and Communications Security (CCS) 2026.