An Analysis of Software Vulnerabilities and Weaknesses in Machine Learning Libraries - Dias, Felipe Cordeiro Alves; Cordeiro, Daniel (Anais do Simpósio Brasileiro de Sistemas de Informação (SBSI); 2026: Anais do XXII Simpósio Brasileiro de Sistemas de Informação, 2026)
Research Context: This article investigates software vulnerabilities and weaknesses across 273 machine learning (ML) library repositories. Scientific and/or Practical Problem: The scientific problem lies in comprehensively mapping security issues within the rapidly expanding landscape of ML libraries. Practically, this research addresses the need for a scalable methodology to effectively track, collect, and correlate existing vulnerabilities and weaknesses in these libraries. Proposed Solution and/or Analysis: We propose a scalable methodology designed to track, collect, and correlate security issues by leveraging CVEs (Common Vulnerabilities and Exposures) and CWEs (Common Weakness Enumeration). Related IS Theory: This research draws upon Complexity Theory, recognizing the intricate interconnectedness of ML ecosystems, where a single change or vulnerability can trigger cascading and unpredictable effects throughout the entire system. Research Method: Our research employed an empirical software analysis approach, involving the mining of 273 machine learning library repositories. We utilized CodeQL and Dependabot as part of the methodology to systematically track, collect, and conduct an in-depth analysis of the interconnections between CWEs and CVEs related to identified vulnerabilities and weaknesses. Summary of Results: Our findings revealed various security flaws, including validation failures, access control issues, memory management errors, development flaws, path-traversal vulnerabilities, and cryptographic weaknesses. Notably, these included CWEs from the Top 25 Most Dangerous Software Weaknesses. These results underscore the critical need for proactive measures to enhance security and reliability within ML systems. Contributions and Impact to IS area: Contributions include an automated methodology for characterizing vulnerabilities and weaknesses in ML libraries; an analysis of vulnerabilities and weaknesses in 273 ML libraries, and a dataset of CVEs/CWEs interconnections for ML.