Search papers, labs, and topics across Lattice.
CrossCommitVuln-Bench, a new benchmark of 15 real-world Python CVEs, reveals that vulnerabilities introduced across multiple commits are largely undetectable by standard per-commit static analysis tools like Semgrep and Bandit. The per-commit detection rate is only 13%, with the few detections being of low quality, while cumulative analysis only achieves 27% detection. Detailed annotations explain why each commit evades detection, highlighting the limitations of current static analysis techniques in identifying cross-commit vulnerabilities.
Static analysis tools miss a staggering 87% of real-world Python vulnerabilities when they're introduced across multiple commits, even when the full codebase is available.
We present CrossCommitVuln-Bench, a curated benchmark of 15 real-world Python vulnerabilities (CVEs) in which the exploitable condition was introduced across multiple commits - each individually benign to per-commit static analysis - but collectively critical. We manually annotate each CVE with its contributing commit chain, a structured rationale for why each commit evades per-commit analysis, and baseline evaluations using Semgrep and Bandit in both per-commit and cumulative scanning modes. Our central finding: the per-commit detection rate (CCDR) is 13% across all 15 vulnerabilities - 87% of chains are invisible to per-commit SAST. Critically, both per-commit detections are qualitatively poor: one occurs on commits framed as security fixes (where developers suppress the alert), and the other detects only the minor hardcoded-key component while completely missing the primary vulnerability (200+ unprotected API endpoints). Even in cumulative mode (full codebase present), the detection rate is only 27%, confirming that snapshot-based SAST tools often miss vulnerabilities whose introduction spans multiple commits. The dataset, annotation schema, evaluation scripts, and reproducible baselines are released under open-source licenses to support research on cross-commit vulnerability detection.
