CrossCommitVuln-Bench: Multi-Commit Vulnerabilities Invisible to Per-Commit Static Analysis

arXiv·high signal

New benchmark of 15 real-world Python CVEs where exploitable conditions were introduced across multiple individually-benign commits that evade per-commit static analysis by Semgrep and Bandit. Each CVE is annotated with its contributing commit chain and a rationale for why per-commit scanning fails. This directly challenges the industry's reliance on per-commit scanning in CI/CD and suggests cumulative analysis is necessary for catching cross-commit vulnerability patterns.