“2025 Open Source Security and Risk Analysis” Report

Who Should Read This Report

The findings of this report will be beneficial for a variety of readers, particularly those involved in securing the software supply chain, as well as those directly involved in software development, security and risk management, and merger and acquisition (M&A) activities.

Developers will gain insights into the types of vulnerabilities that we found prevalent in open source software, such as cross-site scripting (XSS) and denial-of-service (DoS) vulnerabilities. For example, the OSSRA report highlights the importance of following input validation and sanitization techniques, which can help developers build more-secure applications.

Further, this report identifies the most common open source components containing vulnerabilities, which will aid developers in making informed decisions when selecting open source libraries and frameworks. For example, development teams should be aware that our data shows that jQuery, jackson-databind, and the Spring Framework often include vulnerabilities that require regular management and patching.

OSSRA 2025 also emphasizes the risks associated with using out-of-date components and the need for all organizations to implement a process for timely updates. As one example, 90% of audited codebases were found to have open source components more than four years out-of-date. Outdated components magnify security risk, provide attackers with an expanded attack surface, and create compliance and compatibility issues. The presence of older open source also suggests that developers are not taking advantage of software improvements and are relying on code that is no longer being maintained. 

Readers with a security focus can leverage the data presented in OSSRA 2025 to improve their vulnerability management processes. For example, the report identifies the top common vulnerabilities and exposures (CVEs) found in our audits, as well as their relationship to common software weaknesses (CWEs).

Risk management professionals can use OSSRA data to inform their strategic decisions about open source software adoption and risk mitigation. The ability to compare vulnerability percentages and other metrics across industries can help risk managers pinpoint areas where their organization is performing well or needs improvement.

The OSSRA data, primarily derived from analysis of M&A targets’ code, provides key insights for professionals involved in merger and acquisition transactions into the kinds of issues they may be taking on in their own transactions, such as common open source license conflicts, the security posture of the target company, and potential operational challenges that could impact the target’s IP value.

What You’ll Learn and Why It Matters

There’s much more open source in your software than you think: Ninety-seven percent of the codebases we evaluated contained open source, with an average 911 OSS components found per application. From an industry perspective, the percentages ranged from 100% in the Computer Hardware and Semiconductors, EdTech, and Internet and Mobile Apps sectors, to a “low” of 79% for Manufacturing, Industrials, and Robotics.

Open source codebases are getting bigger and more complicated: Our data shows that the number of open source files in an average application has tripled in just the last four years. One of the reasons behind this is the use of “transitive dependencies”—open source libraries that other software components rely on to function. Open source frequently uses other open source. Our audits found that 64% of open source components identified in our scans were transitive dependencies, most nearly impossible to locate or track without using an automated tool. Finding all instances of a transitive dependency can be like searching for a needle in a haystack when you lack an up-to-date inventory of third-party code.

Where all this open source is coming from: Our audits show that the majority of open source is being downloaded from package manager repositories. Over 280,000 of the nearly 1 million OSS components found in our audits originated from one such repository—npm, a massive public database of JavaScript packages.

Whether you think of open source as “free” or not, it comes at a cost: The odds are better than 80% that an application your organization is using right now contains high- or critical-risk open source vulnerabilities, with nearly half of those introduced by transitive dependencies.

Transitive dependencies present licensing and maintenance issues as well as security challenges: Our audits found that over half the codebases contained license conflicts, many caused by a transitive dependencies’ incompatibility with another component’s license. Nearly 30% of component license conflicts found in our audits were caused by transitive dependencies.

Static application security testing (SAST) and dynamic application security testing (DAST) can help identify coding errors: These testing methods can find errors such as input validation and sensitive information exposure, and mistakes like not encrypting important data when it’s being sent over the internet, outdated or weak encryption methods, and failing to properly protect passwords or other secret information.

Every organization using web applications and services should be evaluating them with software composition analysis (SCA) and DAST tools: Development and security teams need to implement a multifaceted security approach integrating DAST, SAST, and SCA to achieve the comprehensive security coverage modern software demands. Our findings indicate that if such a full-spectrum approach were applied, potential exposure to critical vulnerabilities would be markedly reduced.