Source note
LLM-Enabled Open-Source Systems in the Wild: An Empirical Study of Vulnerabilities in GitHub Security Advisories
Summary
This paper studies how vulnerabilities show up in open-source software that uses LLM components, using GitHub Security Advisories from Jan 2025 to Jan 2026. It finds that the code-level bugs are mostly familiar software weaknesses, while LLM-specific risk appears more clearly at the system-design level through OWASP LLM categories.
Problem
- The paper asks whether standard advisory fields such as CWE are enough to describe vulnerabilities in LLM-enabled open-source systems.
- This matters because LLM software connects prompts, model output, tools, file systems, APIs, and agents, so the path from input to harm can pass through model behavior that normal package metadata does not describe.
- If advisory schemas miss that layer, security teams can see the bug class but miss how LLM use, prompt flow, or tool authority makes exploitation possible.
Approach
- The authors collected 295 GitHub Security Advisories published between January 2025 and January 2026 that referenced LLM-related terms.
- They manually reviewed 133 unique affected packages and grouped them into LLM-associated (84 packages, 226 advisories), Possible LLM-associated (16 packages, 34 advisories), and Non-LLM-associated (33 packages, 35 advisories).
- They then randomly sampled 100 advisories from the first two groups and manually labeled them with the OWASP Top 10 for LLM Applications 2025 to capture model-mediated exposure patterns.
- The core mechanism is simple: use CWE to describe the implementation bug, and use OWASP LLM categories to describe how LLM-specific system behavior exposes or amplifies that bug.
- Annotation reliability was reported as Cohen's kappa = 0.76 and Gwet's AC1 = 0.95.
Results
- Across the full 295-advisory set, the authors found 99 distinct CWE IDs. The most common were CWE-94 code injection (24), CWE-502 unsafe deserialization (22), CWE-77 command injection (22), CWE-78 OS command injection (19), CWE-79 XSS (19), and CWE-22 path traversal (18).
- In the 100-advisory OWASP-annotated sample, the top LLM risk categories were Supply Chain / LLM03 (44%), Excessive Agency / LLM06 (20%), Prompt Injection / LLM01 (18%), Sensitive Information Disclosure / LLM02 (17%), Unbounded Consumption / LLM10 (17%), Improper Output Handling / LLM05 (12%), Data and Model Poisoning / LLM04 (7%), and Vector and Embedding Weaknesses / LLM08 (1%).
- 37% of annotated advisories had multiple OWASP labels, which shows that many issues combine several stages such as prompt manipulation, unsafe output use, and privileged tool execution.
- The most common OWASP label combinations were LLM03+LLM06 (12 cases), LLM01+LLM05 (10), LLM01+LLM06 (10), and LLM01+LLM05+LLM06 (7).
- Advisory metadata covered package ecosystem and severity, but it did not include a structured field for LLM involvement. By ecosystem, the 295 advisories included PyPI 162, npm 96, Go 22, Packagist 10, crates.io 3, and Maven 3.
- The main claim is that the study found no new LLM-specific implementation weakness classes. The gap is in reporting: CWE captures the code defect, while OWASP LLM categories capture the model-mediated exposure path that GHSA metadata often misses.