Nearly nine in ten (86%) of commercial codebases evaluated by Black Duck contained open source software vulnerabilities, with eight in ten (81%) containing high- or critical-risk vulnerabilities, research from the firm showed.

The new 2025 Open Source Security and Risk Analysis report is based on the Black Duck Audit team’s evaluation of the anonymised findings from 1,658 analyses of 965 commercial codebases across 16 industries during 2024.

Black Duck’s data shows that the number of open source files in an average application has tripled, from more than 5,300 in 2020 to more than 16,000 in 2024.

“The 2025 OSSRA report underscores a critical and ongoing challenge for organisations: managing the security and compliance risks inherent in open source software,” said Jason Schmitt, CEO of Black Duck.

“As open source adoption continues to grow at an incredible velocity, businesses need to implement robust software composition analysis and risk management strategies to build trust into their applications, data and intellectual property.”

The Black Duck Audit team also found that the vast majority (90%) of audited codebases were found to have open source components more than four years out-of-date.

Outdated components magnify security risks, provide attackers with an expanded attack surface and create compliance and compatibility issues.

The presence of older open source also suggests that developers need to take advantage of software improvements.

jQuery, a Javascript library, was found to be the most frequent source of vulnerabilities. Each of the top ten high-risk vulnerabilities were found in jQuery. In fact, 43% of the applications Black Duck scanned contained some version of jQuery, frequently an outdated version.

The most frequently found high-risk vulnerability was CVE-2020-11023, an XSS vulnerability affecting outdated versions of jQuery, but still present in a third of scanned codebases.

Recommended reading

• Alarming Surge in High-risk Open Source Vulnerabilities
• High Risk Sectors Have the Most Critical Vulnerabilities
• Published Vulnerabilities Surge by 43% in H1 2024

Over half (56%) of the audited codebases contain license conflicts, the audit team found. Transitive dependencies – open source libraries that other software components rely on to function – caused nearly 30% of the license conflicts found in the audits.

Additionally, a third (33%) of codebases contained open source with no license or a customised license.

Only about three in four (77%) of dependencies could be identified via package manager scanning, suggesting that the remainder were introduced to applications by other means, including AI coding assistants.

These blind spots are what lead to lingering unpatched vulnerabilities, outdated components, and license conflicts.