CVE reachability with an LLM and a code graph

<p>Asking a language model whether a CVE affects your code is easy. Deciding when not to believe the answer is the hard part.</p> <p>On one real project we started with a hundred critical CVEs and went through them by hand. Seven or eight out of ten could not be reached from our code. That ratio comes from one codebase, so treat it as an anecdote. Anyone who runs a scanner knows the effect anyway:

Read the source →