一句话：实证分析295份LLM相关GitHub安全公告，发现传统CWE覆盖实现缺陷但低估模型介导风险，需结合OWASP LLM Top 10。
问题：LLM日益嵌入开源软件，传统漏洞披露框架是否充分捕捉模型介导风险尚不清楚。方法：分析2025年1月至2026年1月间引用LLM组件的295份GitHub安全公告，并依据OWASP LLM应用Top 10 2025人工标注其中100份。结果：未发现LLM系统特有的新实现级弱点类别，多数公告映射到既有CWE，尤其是注入与反序列化；OWASP视角揭示供应链、过度代理、提示注入等架构风险模式，且常跨执行阶段共现。结论：现有公告元数据能捕捉代码缺陷，但低估模型介导暴露；结合CWE与OWASP可获得更完整、必要的漏洞视图。
Large language models (LLMs) are increasingly embedded in open-source software (OSS) ecosystems, creating complex interactions among natural language prompts, probabilistic model outputs, and execution-capable components. However, it remains unclear whether traditional vulnerability disclosure frameworks adequately capture these model-mediated risks. To investigate this, we analyze 295 GitHub Security Advisories published between January 2025 and January 2026 that reference LLM-related components, and we manually annotate a sample of 100 advisories using the OWASP Top 10 for LLM Applications 2025. We find no evidence of new implementation-level weakness classes specific to LLM systems. Most advisories map to established CWEs, particularly injection and deserialization weaknesses. At the same time, the OWASP-based analysis reveals recurring architectural risk patterns, especially Supply Chain, Excessive Agency, and Prompt Injection, which often co-occur across multiple stages of execution. These results suggest that existing advisory metadata captures code-level defects but underrepresents model-mediated exposure. We conclude that combining the CWE and OWASP perspectives provides a more complete and necessary view of vulnerabilities in LLM-integrated systems.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2604-04288,
title = {LLM-Enabled Open-Source Systems in the Wild: An Empirical Study of Vulnerabilities in GitHub Security Advisories},
author = {Fariha Tanjim Shifat and Hariswar Baburaj and Ce Zhou and Jaydeb Sarker and Mia Mohammad Imran},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805532}
}