CIRCL/vulnerability-cwe-patch

Description

This dataset, CIRCL/vulnerability-cwe-patch, provides structured, real-world vulnerabilities enriched with CWE identifiers and corresponding patches from platforms like GitHub and GitLab. It is designed to support the development of tools for vulnerability classification, triage, and automated remediation. Each entry includes metadata such as CVE/GHSA ID, a description, CWE categorization, and links to verified patch commits with associated diff content and commit messages.

The dataset is automatically extracted via a pipeline that fetches vulnerability records from multiple sources, filters out entries without patches, and verifies the accessibility of patch links. Patches are then fetched, base64-encoded, and stored alongside commit messages for the training and evaluation of machine learning models.

The dataset consists of 39,260 vulnerabilities and 49,001 associated patches. For training purposes, only patches corresponding to vulnerabilities annotated with at least one CWE are considered.

How to use with datasets

>>> import json
>>> from datasets import load_dataset

>>> dataset = load_dataset("CIRCL/vulnerability-cwe-patch")

>>> vulnerabilities = ["CVE-2025-60249", "CVE-2025-32413"]

>>> filtered_entries = dataset.filter(lambda elem: elem["id"] in vulnerabilities)

>>> for entry in filtered_entries["train"]:
...     print(entry["cwe"])
...     for patch in entry["patches"]:
...         print(f"  {patch['commit_message']}")
...
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')     
  [PATCH] fix: [security] Fixed a stored XSS vulnerability in user bios. Thanks to Dawid Czarnecki for reporting the issue.
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
  [PATCH] fix: [security] sanitize user input in comments, bundles, and sightings - Escaped untrusted data in templates and tables to prevent XSS - Replaced unsafe innerHTML assignments with createElement/textContent - Encoded dynamic URLs using encodeURIComponent - Improved validation in Comment, Bundle, and Sighting models Credit: @Wachizungu

Schema

Each example contains:

- id: Vulnerability identifier (e.g., CVE-2023-XXXX, GHSA-XXXX)

- title: Human-readable title of the vulnerability

- description: Detailed vulnerability description

- patches: List of patch records, each with:

    url: Verified patch URL (GitHub/GitLab)

    patch_text_b64: Base64-encoded unified diff

    commit_message: Associated commit message

- cwe: List of CWE identifiers and names

The vulnerabilities can be sourced from:

- NVD CVE List — enriched with commit references

- GitHub Security Advisories (GHSA)

- GitLab advisories

- CSAF feeds from vendors including Red Hat, Cisco, and CISA

Use Cases

The dataset supports a range of security-focused machine learning tasks:

* Vulnerability classification

* CWE prediction from descriptions

* Patch generation from natural language

* Commit message understanding

Associated Code

The dataset is generated with the extraction pipeline from vulnerability-lookup/ML-Gateway, which includes logic for fetching, filtering, validating, and encoding patch data.