ryal-xyz/vul-mine-vulnerability-dataset

VulMine vulnerability dataset

VulMine is a strict, naturally imbalanced function/method-level vulnerability dataset mined from public OSV advisories and immutable public Git revisions. The default configuration covers Java, Python, and JavaScript. The c-cpp configuration is a C/C++ language control built with the same VulMine label and cleaning principles for comparisons with Big-Vul.

Release

The default configuration contains vulmine-clean-v1.2.

The negative-to-positive ratio is approximately 22.7:1. This is the natural output of the mining and cleaning procedure, not an estimate of operational vulnerability prevalence.

The c-cpp configuration contains vulmine-clean-cc-v1.0:

Its negative-to-positive ratio is approximately 45.2:1. It is intended as a same-language control, not as a reproduction or drop-in replacement for Big-Vul.

The supplied splits are grouped by repository. Across splits there are:

• —zero shared repositories;
• —zero shared sample IDs;
• —zero shared normalized-code hashes.

Labels

• —vul=1: a pre-fix callable touched by a security-fix patch and accepted by the strict quality policy.
• —vul=0: a callable found in a modified source file that is unchanged across the fix and does not share its normalized-code hash with any positive.
• —vulnerable_lines_unit: 1-based candidate vulnerable-line positions within before_code.
• —patched_lines_unit: 1-based patch-line positions within after_code.

Every positive has at least one in-bounds vulnerable-line position. Every negative has identical before_code and after_code and empty callable-level line-label arrays.

These are automatically derived silver labels. A patch-touched line is not proof of semantic root cause, and an unchanged function is not proof that it is vulnerability-free.

Loading

from datasets import load_dataset

dataset = load_dataset(
    "ryal-xyz/vul-mine-vulnerability-dataset",
)
print(dataset)
print(dataset["train"][0])

Load the C/C++ control explicitly:

cc_dataset = load_dataset(
    "ryal-xyz/vul-mine-vulnerability-dataset",
    "c-cpp",
)

The Parquet files are sharded and can also be streamed:

dataset = load_dataset(
    "ryal-xyz/vul-mine-vulnerability-dataset",
    streaming=True,
)

Provenance and validation

The metadata/ directory contains:

• —the complete cleaning configuration and rejection audit;
• —deterministic repository-to-split assignments;
• —checksums for the original strict JSONL release;
• —checksums for every uploaded Parquet and metadata file;
• —the machine-readable mining and release summary;
• —a schema and field-semantics reference.

The default release contains 317,814 unique sample IDs and normalized-code hashes from 2,464 repositories. The C/C++ release contains 470,626 unique sample IDs and normalized-code hashes from 1,309 repositories. For both configurations, the cleaner and a separately implemented whole-release validator passed.

Source coverage

The July 2026 default run ingested OSV snapshots for Maven, npm, and PyPI:

• —254,624 advisory records;
• —18,018 explicit fix-commit references;
• —11,933 successfully mined commits.

Only explicit commit references were followed. The miner did not guess commits from issue, pull-request, release, or advisory text.

The August 2026 C/C++ control ingested Android, GIT, Linux, and OSS-Fuzz OSV snapshots, then applied a deterministic C/C++ GitHub language allowlist before fetching 32,769 eligible commit references. Its metadata directory contains the exact cleaning audit, split assignments, checksums, and run summary.

Limitations

• —The dataset over-represents projects with machine-readable advisories and explicit public fix commits.
• —Security fixes can contain refactoring, cleanup, and unrelated hardening.
• —Same-file unchanged functions are useful hard negatives but can still contain latent vulnerabilities.
• —cvss_score is null in this release and should not be used for severity experiments.
• —The supplied class ratio reflects the extraction process, not deployment prevalence.

Licensing

The VulMine pipeline is MIT licensed. Dataset records contain third-party source code and metadata that retain their original upstream licenses and terms. No single license is asserted over the combined source-code corpus. Users are responsible for checking the repo_url, file provenance, and upstream license before redistribution or use that requires particular licensing conditions.

Citation

Until a formal publication is available, cite the dataset repository, the configuration and release name (vulmine-clean-v1.2 or vulmine-clean-cc-v1.0), and the immutable Hub commit used in your experiment.

The pipeline, methodology, tests, and full local reproduction documentation are maintained separately in the VulMine source repository.