Construction software often uses vulnerable third-party components
What Is Under the Hood? A Cross-Ecosystem Study of Vulnerable Dependencies in Construction Software
Software Engineering
Summary
Construction software often relies on code from other sources, which can have security problems. The authors studied over 900 construction-related projects on GitHub and found that many had hidden vulnerabilities in their dependencies. They discovered that most repositories with vulnerabilities had serious risks and that just a few key external packages caused many of these issues. Their work highlights the need for better tracking and understanding of software dependencies to improve security in construction software.
What this means in practice
- •For construction software developers: Identify and address high-risk vulnerabilities in third-party dependencies used in construction software to enhance security.
- •For software supply chain security teams: Focus security assessments on the small number of upstream package families that contribute most to vulnerability risks in construction-related software.
Authors
Mahzabin Tamanna, S M Jamil Uddin
Abstract
The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.