JsVul introduces curated JavaScript and TypeScript vulnerability dataset
A Function-level Dataset of Vulnerable and Fixed Source Code in JavaScript and TypeScript
Cryptography and SecuritySoftware Engineering
Summary
Finding software bugs that cause security problems needs good examples of code before and after fixing those bugs. The authors gathered a large set of JavaScript and TypeScript code with known security fixes, carefully cleaned it to remove confusing or unhelpful parts, and organized it to help teach computers how to spot similar issues automatically. This dataset focuses specifically on these two languages and is ordered by time, making it useful for building better security tools. The work shows that paying attention to language details helps improve the quality of such datasets.
What this means in practice
- •For software security teams: Train automated tools to detect security flaws in JavaScript and TypeScript code more reliably using a curated dataset of real fixes.
- •For web application developers: Improve security testing by integrating more focused datasets that reflect actual vulnerability fixes in common web development languages.
Authors
Tamás Viszkok, Péter Hegedűs
Abstract
JavaScript and TypeScript are widely used in modern web development, making their security critical; however, automated vulnerability detection is often constrained by the availability of high-quality training data. Here we present JsVul, a dataset curated from seven major sources. Unlike generic multi-language datasets that may retain noise -- such as minified code and cosmetic edits -- JsVul utilizes a language-specific pipeline. We collected pre-fix and post-fix versions of files around security fixes and, by filtering irrelevant artifacts and applying automated syntax normalization, isolated security-related changes. We ensured data integrity through multi-stage deduplication and heuristic-based labeling. Provided in a time-ordered JSONL format, JsVul supports robust model training in the JavaScript and TypeScript ecosystem and demonstrates the importance of language-aware preprocessing in building vulnerability datasets.