CrossCommitVuln-Bench: A Dataset of Multi-Commit Python Vulnerabilities Invisible to Per-Commit Static Analysis

CrossCommitVuln-Bench is a curated benchmark of 15 real-world Python CVEs in which the exploitable condition was introduced across multiple commits—each individually benign to per-commit static analysis (SAST)—but collectively critical. The dataset includes: - Structured annotation.json for each CVE (contributing commits, chain rationale, per-commit SAST results, and why each commit evades per-commit detection) - reproduction.md for each CVE - Evaluation scripts (Semgrep + Bandit per-commit and cumulative baselines) - Baseline metrics: CCDR=13% (2/15 caught per-commit), CDR=27% (4/15 caught cumulatively) - 6 negative examples (SKIP) with documented exclusion rationale