CrossCommitVuln-Bench: A Dataset of Multi-Commit Python Vulnerabilities Invisible to Per-Commit Static Analysis

CrossCommitVuln-Bench is a curated benchmark of 30 real-world Python CVEs in which the exploitable condition was introduced across multiple commits — each individually benign to per-commit static analysis (SAST) — but collectively critical. The dataset includes: - annotation.json for each CVE (contributing commits, chain rationale, per-commit SAST results, and why each commit evades per-commit detection) - reproduction.md for each CVE - Evaluation scripts (Semgrep + Bandit + CodeQL per-commit and cumulative baselines) - Baseline metrics: CCDR=7% (2/30 caught per-commit), CDR=13% (4/30 caught cumulatively) - 6 additional annotated CVEs beyond the benchmark set (36 total in this archive) Published at: AIware 2026 (3rd ACM International Conference on AI-Powered Software). Paper DOI: 10.1145/3805760.3814928