Cross-language generalization of vulnerability patterns

Determine whether the vulnerability patterns observed in LLM-generated C and C++ code generalize to other programming languages, including Python and JavaScript.

Background

The LLMVul dataset focuses exclusively on C and C++ functions mined from real production repositories and labeled using a static-analysis ensemble. Its findings therefore establish vulnerability patterns only for these two languages. The paper explicitly identifies the transferability of those patterns to other languages, specifically Python and JavaScript, as unresolved.

References

LLMVul currently focuses on C and C++; whether the observed patterns generalize to other programming languages, such as Python and JavaScript, remains an open question.

— LLMVul: A Vulnerability-Labeled Dataset of LLM-Generated C/C++ Functions from Real Production Repositories  (2609.10945 - Farhad et al., 10 Sep 2026) in Section 7, “Threats to Validity”