A Python toolkit for loading, unifying, and enriching Vulnerability-Fixing Commit (VFC) datasets.
Plenty of VFC datasets exist, but they differ in schema, content, and completeness. Some were built years ago and contain stale data, such as project URLs that have since moved between hosting platforms. vfc_datasets loads the datasets through a single interface and yields a shared DatasetEntry. Transformations let you deduplicate, filter, sanitize, and enrich entries with commit data (message, diff, files changed, timestamp).
Open the repo in VS Code and run Reopen in Container to use the provisioned devcontainer.
Alternatively, install into your own environment (requires Python 3.12+):
pip install -e .All settings have sensible defaults. To override them, copy .env.example to .env and adjust as needed.
See examples/ for scripts covering loading, combining, transforming, and enriching entries with commit data.
Commit-level (22 datasets)
| Year | Dataset | VFCs* | Non-VFCs* | Projects* | Paper |
|---|---|---|---|---|---|
| 2017 | SecBench | 676 | 0 | 113 | link |
| 2019 | Devign | 10,894 | 14,978 | 2 | link |
| 2019 | MSR2019 | 1,282 | 0 | 205 | link |
| 2020 | BigVul | 4,428 | 0 | 425 | link |
| 2021 | CC900 | 3,762 | 6,347 | 917 | link |
| 2021 | CVEFixes | 13,297 | 0 | 4,207 | link |
| 2021 | CrossVul | 5,877 | 0 | 1,662 | link |
| 2021 | PatchDB | 10,691 | 23,742 | 406 | link |
| 2021 | SPIDB | 10,894 | 14,979 | 2 | link |
| 2021 | TQRG | 8,053 | 110,161 | 1,334 | link |
| 2022 | Tracer | 3,017 | 0 | 767 | link |
| 2022 | VCMatch | 1,669 | 0 | 10 | link |
| 2022 | VUDEnc | 1,009 | 0 | 784 | link |
| 2023 | PySecDB | — | — | — | link |
| 2024 | JavaVFC | 784 | 0 | 263 | link |
| 2024 | Morefixes | 47,616 | 0 | 9,883 | link |
| 2024 | RepoSPD | 18,127 | 31,397 | 364 | link |
| 2025 | BigVulFixes | 1,745 | 27,211 | 713 | link |
| 2025 | CommitVulFix | 681 | 1,118 | 233 | link |
| 2025 | DIMVA2025 | 2,798 | 0 | 1,246 | link |
| 2025 | FixSeeker | 9,885 | 10,979 | 2,011 | link |
| 2025 | PatchEval | 1,173 | 0 | 694 | link |
*Generated by this toolkit.Datasets shipping several variants are listed once.
Function-level (8 datasets)
| Year | Dataset | Vuln. Fns* | Benign Fns* | Projects* | Paper |
|---|---|---|---|---|---|
| 2023 | DiverseVul | 18,945 | 311,547 | 780 | link |
| 2023 | SVEN | 800 | 0 | 269 | link |
| 2024 | CWEBenchJava | 1,119 | 0 | 88 | link |
| 2024 | CleanVul | 8,198 | 0 | 1,905 | link |
| 2024 | MegaVul | 20,267 | 367,147 | 1,495 | link |
| 2024 | PrimeVul | 6,003 | 218,474 | 782 | link |
| 2025 | ICVul | 6,276 | 9,120 | 675 | link |
| 2025 | SecVulEval | 10,992 | 14,435 | 736 | link |
*Generated by this toolkit.
Issues and PRs are very welcome, especially for new VFC datasets:
- Adding one: see
vfc_datasets/commit_level/andvfc_datasets/function_level/for reference implementations. - Suggesting one: open an issue pointing to the dataset.
If you use any of these datasets for your research, please cite the original dataset authors. Paper titles and URLs are available via DatasetClass.metadata.paper_url.
If you find our toolkit useful, please consider citing it as:
@misc{vfc-datasets,
title={Code-Centric Detection of Vulnerability-Fixing Commits: A Unified Benchmark and Empirical Study},
author={Nils Loose and Joseph Bienhüls and Kristoffer Hempel and Felix Mächtle and Thomas Eisenbarth},
year={2026},
eprint={2605.13138},
archivePrefix={arXiv},
primaryClass={cs.SE},
url={https://arxiv.org/abs/2605.13138},
}