auren-research/cve-sft-v5

CVE SFT Dataset v5

<p align="center"> <img src="https://img.shields.io/badge/Records-10%2C000-blue" alt="10,000 Records"> <img src="https://img.shields.io/badge/Source-NVD%2FNIST-orange" alt="NVD/NIST"> <img src="https://img.shields.io/badge/Fields-12-green" alt="12 Fields"> <img src="https://img.shields.io/badge/License-CC--BY--4.0-lightgrey" alt="CC BY 4.0"> <img src="https://img.shields.io/badge/Task-SFT%20%2F%20Fine--Tuning-purple" alt="SFT"> </p>

CVE SFT Dataset v5 is a structured instruction-following dataset for fine-tuning language models on cybersecurity vulnerability analysis. Built by Auren Research, it combines authoritative vulnerability metadata from the NIST National Vulnerability Database (NVD) with five generated fields that teach models to explain, reason about, and remediate real-world CVEs — including side-by-side vulnerable vs. safe code examples.

Unlike most security datasets that provide only raw CVE descriptions and CVSS scores, this dataset trains models to produce structured, actionable security intelligence: attack scenarios, root cause analysis, and concrete remediation steps with validation.

Why This Dataset

Security-focused LLMs face a consistent gap: they can recite CVE descriptions but struggle to reason about exploitation paths, explain root causes to non-experts, or generate accurate remediation guidance. This dataset directly addresses that gap by providing:

• —Plain-language explanations accessible to non-security audiences
• —Technical deep dives covering root cause, impact, and attack context
• —Attack scenarios structured as recon → execution → objective
• —Remediation guidance with immediate fix + 3 additional mitigations + validation steps
• —Vulnerable vs. safe code pairs — the most requested and rarest field in open security datasets

This dataset was built by a researcher with hands-on vulnerability research experience, including reported findings on HackerOne across blockchain and smart contract targets.

Dataset Statistics

Severity Distribution

Top 10 CWE Categories

Dataset Schema

Data Quality

Deduplication was performed on all generated fields. Results:

The low duplication rates — particularly 0% on plain_explanation and near-zero on remediation — indicate the generated content is genuinely diverse and not template-collapsed.

Usage

from datasets import load_dataset
import pandas as pd

# Load via HuggingFace datasets
ds = load_dataset("auren-research/cve-sft-v5", split="train")

# Or load directly from parquet
df = pd.read_parquet("cve_sft_dataset_v5.parquet")

# Example: filter critical CVEs with code examples
critical = df[
    (df["cvss_score"] >= 9.0) &
    (df["vulnerable_code_example"].str.len() > 100)
]
print(f"Critical CVEs with code examples: {len(critical)}")

# Example: inspect a single record
row = df.iloc[0]
print(f"CVE: {row['cve_id']}")
print(f"CVSS: {row['cvss_score']} | CWE: {row['cwe_id']}")
print(f"\nPlain explanation:\n{row['plain_explanation']}")
print(f"\nAttack scenario:\n{row['attack_scenario']}")
print(f"\nRemediation:\n{row['remediation']}")

SFT Training Example

def format_for_sft(row):
    """Format a CVE record as an instruction-following example."""
    instruction = (
        f"Analyze the following vulnerability: {row['cve_id']}\n"
        f"Affected software: {row['affected_software']}\n"
        f"CVSS Score: {row['cvss_score']} | CWE: {row['cwe_id']}\n"
        f"CVSS Vector: {row['cvss_vector']}"
    )
    response = (
        f"## Plain Explanation\n{row['plain_explanation']}\n\n"
        f"## Technical Deep Dive\n{row['technical_deep_dive']}\n\n"
        f"## Attack Scenario\n{row['attack_scenario']}\n\n"
        f"## Remediation\n{row['remediation']}\n\n"
        f"## Code Example\n{row['vulnerable_code_example']}"
    )
    return {"instruction": instruction, "response": response}

df["formatted"] = df.apply(format_for_sft, axis=1)

Intended Use Cases

• —Fine-tuning security-focused LLMs on structured vulnerability reasoning
• —Training code security assistants using the vulnerable/safe code pairs
• —Security education — teaching developers to recognize and fix common vulnerability patterns
• —Red team tooling — grounding LLM-based recon and exploitation reasoning in real CVE data
• —Benchmarking LLM security knowledge across CWE categories and severity levels
• —RAG pipelines for security operations centers (SOC) and vulnerability management platforms

Limitations

• —Generated fields are LLM-produced and have not been manually reviewed by security researchers for every record. A small number of records (~2%) may contain templated or lower-quality outputs in technical_deep_dive and vulnerable_code_example
• —Code examples are illustrative and may not exactly reproduce the specific CVE's vulnerable codebase — they demonstrate the vulnerability class, not the exact affected code
• —Attack scenarios are structured for educational purposes and intentionally omit weaponizable exploit details
• —Coverage bias: the dataset reflects NVD publication patterns — CWE-79 (XSS) is heavily represented because it is the most commonly reported vulnerability class
• —Version coverage: records use NVD data as of v5 build date — newer CVEs are not included

Ethical Considerations

This dataset is intended for defensive security use cases: training models that help developers write safer code, security teams triage vulnerabilities faster, and organizations understand their exposure.

The attack scenarios are structured at a conceptual level (recon → execution → objective) and do not include weaponized exploit code, working proof-of-concept payloads, or specific bypass techniques for active CVEs.

Users should not use this dataset to build tools that automate offensive exploitation of unpatched systems.

Citation

@dataset{auren2026cvesft,
  title   = {CVE SFT Dataset v5: Structured Vulnerability Intelligence for LLM Fine-Tuning},
  author  = {Francisco Antonio Da Costa Barroso},
  year    = {2026},
  publisher = {Auren Research},
  url     = {https://huggingface.co/datasets/auren-research/cve-sft-v5}
}

Related Work from Auren Research

• —[PII Shield](https://huggingface.co/datasets/auren-research/pii-shield) — 3.1M+ multilingual PII detection examples across 6 languages
• —[Lunaris Guard](https://huggingface.co/auren-research/lunaris-guard) — Dual-head multilingual safety classifier (ROC-AUC 0.979 on prompt injection)
• —[Lunaris MoC](https://github.com/Auren-Research/lunaris) — Novel sparse Transformer architecture with mediator-based expert collaboration

Built by [Francisco Antonio Da Costa Barroso](https://github.com/MeryylleA) · Auren Research · 2026