Python Import as an Execution Boundary: An Empirical Study of Bugs, Vulnerabilities, and Analysis Gaps

• URL: http://arxiv.org/abs/2609.14791v1
• Date: Sun, 13 Sep 2026 21:06:35 GMT
• Title: Python Import as an Execution Boundary: An Empirical Study of Bugs, Vulnerabilities, and Analysis Gaps
• Abstract summary: We study import-related bugs and security vulnerabilities in Python software.<n>We use security advisories with PyPI project histories to confirm how import activates cases.<n>We derive ImportVulBench, 228 paired pre-fix and fixed programs covering all 11 bug types.
• Score: 7.13396930901845
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Python import does more than resolve dependencies: it executes code during module and package initialization. This behavior can trigger failures, load dynamic or native code, access resources, or change security-sensitive state before an application calls a package API. Prior work studies package selection, malicious packages, or package vulnerabilities. We present ImportMine, a study of import-related bugs and security vulnerabilities in Python software. We combine security advisories with PyPI project histories and use source and patch evidence to confirm how import activates cases, why the problem occurs, how developers fix it, and what program information is needed to explain the behavior. We retain 31 import-related advisory vulnerabilities and 38 application-data boundary cases and confirm 1,429 project-history bugs across 1,302 repositories. Among the project-history bugs activated during initialization, 97.6% stop or disrupt normal execution. In contrast, 90.0% of the 20 initialization- activated advisory vulnerabilities are High or Critical. Module-level code and package initialization activate 98.3% of the analyzed history cases. Dynamic loading is much less common, but most of its cases perform security-sensitive actions. We also find that many fixes change when an import becomes active instead of removing the dependency. Finally, we derive ImportVulBench, 228 paired pre-fix and fixed programs covering all 11 bug types.

Related papers

• SkillAtlas: An Attack Trace Library for Agent Skills [67.18648151130607]
  We present SkillAtlas, a hosted attack trace library that converts private agent-skill security report bundles into reviewed, redacted, and searchable public cases.<n>The library contains 3,014 cases, 6,589 traces, 151,131 steps, 233 affected skills, and 8 risk categories.
  arXiv  Detail & Related papers  (2026-09-11T16:44:39Z)
• VeriPort: Automated and Verified Patch Backporting at Scale [41.76637014069122]
  We present VeriPort, an end-to-end agentic system that backports a patch for a given vulnerability advisory to every affected version of the package.<n>For each backport, VeriPort builds a chain of evidence to confirm that the patch blocks exploitation and preserves intended behavior.<n>We deployed VeriPort on 169 high- and critical-severity CVEs and have generated over 5,000 verified backported patches.
  arXiv  Detail & Related papers  (2026-06-21T22:45:33Z)
• Correct Code, Vulnerable Dependencies: A Large Scale Measurement Study of LLM-Specified Library Versions [52.50730821321986]
  We present the first large-scale measurement study of version-level risk in large language models (LLMs)<n>We evaluate 10 LLMs on PinTrace, a curated benchmark of 1,000 Stack Overflow programming tasks.<n>Our findings reveal LLM version selection as a first-class, previously overlooked risk surface in LLM-based development.
  arXiv  Detail & Related papers  (2026-05-07T13:52:59Z)
• LLM-Guided Issue Generation from Uncovered Code Segments [2.9610847900970856]
  IssueSpecter finds bugs in uncovered code segments and automatically generates prioritized, actionable issue reports.<n>We evaluate IssueSpecter on 13 actively maintained Python projects, generating 10,467 issue reports.
  arXiv  Detail & Related papers  (2026-04-28T21:10:53Z)
• Cross-Ecosystem Vulnerability Analysis for Python Applications [8.776396282382864]
  Python applications depend on native libraries that may be vendored within package distributions or installed on the host system.<n>Current vulnerability scanners produce false negatives by missing vendored vulnerabilities and false positives by ignoring security patches backported by OS distributions.<n>We present a provenance-aware vulnerability analysis approach that resolves vendored libraries to specific OS package versions or upstream releases.
  arXiv  Detail & Related papers  (2026-03-19T09:52:29Z)
• Why Authors and Maintainers Link (or Don't Link) Their PyPI Libraries to Code Repositories and Donation Platforms [83.16077040470975]
  Metadata of libraries on the Python Package Index (PyPI) plays a critical role in supporting the transparency, trust, and sustainability of open-source libraries.<n>This paper presents a large-scale empirical study combining two targeted surveys sent to 50,000 PyPI authors and maintainers.<n>We analyze more than 1,400 responses using large language model (LLM)-based topic modeling to uncover key motivations and barriers related to linking repositories and donation platforms.
  arXiv  Detail & Related papers  (2026-01-21T16:13:57Z)
• Analyzing the Availability of E-Mail Addresses for PyPI Libraries [89.21869606965578]
  81.6% of libraries include at least one valid e-mail address, with PyPI serving as the primary source.<n>We identify over 698,000 invalid entries, primarily due to missing fields.
  arXiv  Detail & Related papers  (2026-01-20T14:54:58Z)
• PyTrim: A Practical Tool for Reducing Python Dependency Bloat [4.121942353083345]
  Dependency bloat is a persistent challenge in Python projects.<n>We introduce PYTRIM, an end-to-end system to automate this process.<n> PYTRIM eliminates unused imports and package declarations across a variety of file types.
  arXiv  Detail & Related papers  (2025-10-01T08:58:55Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• An Empirical Study of Malicious Code In PyPI Ecosystem [15.739368369031277]
  PyPI provides a convenient and accessible package management platform to developers. The rapid development of the PyPI ecosystem has led to a severe problem of malicious package propagation. We conduct an empirical study to understand the characteristics and current state of the malicious code lifecycle in the PyPI ecosystem.
  arXiv  Detail & Related papers  (2023-09-20T02:51:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.