← all corpora

vuln-fix-commits

reference corpus · status live · domain SEC (Security and vulnerabilities) · lane A · refresh weekly · tags GLOBAL · VULNERABILITIES · SECURITY · FIX-COMMITS

What an agent uses it for

an agent confirming a vulnerability is actually fixed queries this for the fixing commit references (SAP project-kb cvefixcommit)

Use it
curl -fsSLO https://raw.githubusercontent.com/xerj-org/xerj/corpus-hub/tools/xerj-code/hub/vuln-fix-commits.json
xerj corpus add --from ./vuln-fix-commits.json
xerj corpus index vuln-fix-commits then xerj code vuln-fix-commits "your question"

Needs the xerj CLI and a local node running; the copy prompt covers both, checks each step, and shows how to stop only the node you started. No shell: the MCP tool xerj_code_search with corpus: "vuln-fix-commits", once the corpus is indexed on the node.

Sources and pins

sourcepinlicencesizereview note
project-kb 3f7ce8ceb90eApache-2.0 383.7 MB / 29,272 files Fix commits for 24,025 CVEs: 29,240 payload records (cve, repo, sha, full commit message, stats, per-file patches) fetched from the project-kb inventory at the pinned sha, beside the MSR2019 dataset (cve/repo/fixcommit + vulnerable version ranges) and the kaybee ground-truth records (buggy/fixed function bodies). Curated after the first G7 run answered every query from the HARVESTING TOOL's own so

383.7 MB across 29,272 files. Added 2026-10-07.

People behind this corpus

Upstream authors (1)

Owners of the pinned repositories, credited under each repository's licence. They have not signed up here; their pages are attribution.

SAP@SAP · upstream

All contributors.

Rights

Apache-2.0. Redistribution permitted with attribution per the licence review. The review block records a human opening each licence file at the pin. Detector output is a hint, never the verdict.

Retrieval spot-check (G7)

4.0/5 relevant. Graded 2026-10-08.

Q: chat template names written as jinja files path traversal outside the target directory
expect: the huggingface/transformers fix for CVE-2026-9856 in top-5, template names like ../../foo flowing into os.path.join letting a saved repo write outside chat_template_dir
top-5: payloads/huggingface_transformers@eaaaf8494dd5386634ae37d1d122212fdc315be5.json / payloads/huggingface_transformers@eaaaf8494dd5386634ae37d1d122212fdc315be5.json / payloads/node-modules_compressing@8d16c196c7f1888fc1af957d9ff36117247cea6c.json / payloads/node-modules_compressing@ce1c0131c401c071c77d5a1425bf8c88cfc16361.json / payloads/[email protected]
grade: pass
Q: SSRF external reference URL probe validate resolved IP address
expect: the flowintel fix for CVE-2026-9813 in top-5, mitigating server-side request forgery in the external reference URL probe
top-5: payloads/agentfront_mcp-from-openapi@be3409cce6e97642696d4ee5a4e4e2712490b277.json / payloads/agentfront_frontmcp@96a78eaa5c6c4bc51cced557d83d1a03344cb03d.json / payloads/flowintel_flowintel@68b523b47854c54bf36fd706c0fd5353063b5409.json / payloads/agentfront_frontmcp@96a78eaa5c6c4bc51cced557d83d1a03344cb03d.json / payloads/[email protected]
grade: pass
Q: notification bell XSS innerHTML replaced with textContent DOM methods
expect: the MISP/cti-transmute fix for CVE-2026-9806 in top-5, rebuilding notification items via DOM methods instead of innerHTML to stop XSS from malicious convert names
top-5: payloads/[email protected] / payloads/[email protected] / payloads/agorafoundation_agora@b087490042cb131963b524d0f86511a63a7ff085.json / payloads/[email protected] / payloads/[email protected]
grade: pass
Q: MMU access rights check unaligned address range last page not checked
expect: the OP-TEE fix for CVE-2019-1010293 in top-5, tee_mmu_check_access_rights missing the final page of a TA buffer when start and length are unaligned
top-5: payloads/[email protected] / payloads/freescout-helpdesk_freescout@33639a89554998dcac645613130a27ac7872605e.json / payloads/beaugunderson_ip-address@56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e.json / payloads/beaugunderson_ip-address@469ead1231b4cc059f2150c626e1e0c2895c0134.json / payloads/beaugunderson_ip-address@8b34a21e0839b37c094066816fb2c2c48a2adcf5.json
grade: pass
Q: stack buffer overflow yaffs filesystem stat time string buffer too small
expect: the sleuthkit fix for CVE-2020-10232 in top-5, growing the yaffsfs_istat time buffer to what tsk_fs_time_to_str requires
top-5: payloads/bacnet-stack_bacnet-stack@4e1176394a5ae50d2fd0b5790d9bff806dc08465.json / payloads/[email protected] / payloads/[email protected] / payloads/michaelrsweet_pdfio@4f10021e7ee527c1aa24853e2947e38e154d9ccb.json / payloads/Ysurac_openmptcprouter@09393d1c41a227bea7d5b85c0a06221b1302b25f.json
grade: miss

Agent score

From structured reviews that AI agents send after they use this corpus: through xerj hub pull, MCP queries, or the xerj_corpus_feedback tool. Each review rates usefulness 1–5, whether the answer was found, and freshness. This is not the human hub star count shown above. The two are never mixed.

Loading agent reviews…

Score = Bayesian mean of usefulness (prior 3.0 with weight 5), so a few reviews cannot swing it. One voice per installation per corpus per week; abnormal-volume reviewers are dropped. Coverage gaps appear only once 3 or more agents report the same one. How it works.

Traffic

Traffic stats load from /api/hub-traffic when this page runs JavaScript.

Views: visits to this page (search-engine crawlers excluded). Unique: distinct visitors per day, by a hash salted with the day, so the 14-day unique figure adds up daily uniques. Pulls: growth of the GitHub release download count of this corpus’s pack (xerj hub pull downloads from there; includes our own pack-verification downloads). Searches: hosted-hub queries for this corpus. Referring sites appear after 3 views. What is collected.

Agent usage

Usage stats load from /api/hub-usage when this page runs JavaScript.

Counted: requests agents send to the hosted hub API (hub.xerj.org/api/v1/code, /def) for this corpus. Queries on your own node (xerj code, xerj ask with a local pack, the MCP tools) never leave your machine and are not counted. Templates replace identifiers, versions, paths, numbers and quoted text with placeholders; one is shown only once it has been seen 3 times in 30 days, and any word asked fewer than 3 times shows as <term>. Raw queries are never published. What is collected.