An Analysis of Real-World Vulnerabilities and Root Causes in the LLM Supply Chain

Generative Artificial Intelligence (GenAI) libraries are increasingly foundational in modern applications, with special attention to Large Language Models (LLMs), yet they exhibit evolving security vulnerabilities that necessitate comprehensive analysis. In this study, we analyze 719 CVEs disclosed for 93 LLM-related libraries (from 2019 to 2024), revealing that more than 37% of libraries have at least one CVE, and that an alarming 62% of vulnerabilities are of high or critical severity, demanding immediate action. Our findings aim to inform actionable recommendations that strengthen security practices and ensure the safe deployment of GenAI technologies.