Where Is the Fix? A Cross-Ecosystem Census of Machine-Actionable Remediation Endpoints in OSV

Authors

Keywords:

OSV, vulnerability remediation, affected versions, open-source security, vulnerability databases, package ecosystems

Abstract

Background: Open Source Vulnerability (OSV) records can describe affected versions with fixed, last_affected, limit, and enumerated-version representations. Only an explicit fixed event directly identifies a version that contains a fix.

References

1. OpenSSF. Open Source Vulnerability format . OSV Schema, checkout v1.9.1-1-g65280fa, commit 65280faa676c7a69bb9208d876b2419f88dd7e03. https://ossf.github.io/osv-schema/

2. OSV.dev. Data sources . https://google.github.io/osv.dev/data/

3. OSV.dev. Properties of a High Quality OSV Record . https://google.github.io/osv.dev/data_quality.html

4. Dong Y, Guo W, Chen Y, Xing X, Zhang Y, Wang G. Towards the Detection of Inconsistencies in Public Security Vulnerability Reports. In: 28th USENIX Security Symposium . 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/dong

5. Ren H, Li X, Lei L, et al. Detecting Inconsistent Vulnerable Software Version in Security Vulnerability Reports. Communications in Computer and Information Science . 2022:78–99. https://doi.org/10.1007/978-981-19-0523-0_6

6. Nguyen VH, Dashevskyi S, Massacci F. An automatic method for assessing the versions affected by a vulnerability. Empirical Software Engineering . 2016;21(6):2268–2297. https://doi.org/10.1007/s10664-015-9408-2

7. He Y, Wang Y, Zhu S, et al. Automatically Identifying CVE Affected Versions With Patches and Developer Logs. IEEE Transactions on Dependable and Secure Computing . 2024;21(2):905–919. https://doi.org/10.1109/TDSC.2023.3264567

8. Wu S, Wang R, Huang K, et al. Vision: Identifying Affected Library Versions for Open Source Software Vulnerabilities. In: Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering . 2024:1447–1459. https://doi.org/10.1145/3691620.3695516

9. Chen X, Liu C, Cao J, et al. Vulnerability-Affected Versions Identification: How Far Are We? In: 2025 40th IEEE/ACM International Conference on Automated Software Engineering . 2025:2970–2982. https://doi.org/10.1109/ASE63991.2025.00244

10. Bhandari G, Naseer A, Moonen L. CVEfixes: automated collection of vulnerabilities and their fixes from open-source software. In: Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering . 2021:30–39. https://doi.org/10.1145/3475960.3475985

11. OSV-Scanner. Guided Remediation . https://google.github.io/osv-scanner/experimental/guided-remediation/

Cybersecurity Advances, Volume 3, Issue 1, 2026 cover for 2026: Vulnerability Intelligence in Operational Systems.

Downloads

Published

2026-10-30

Issue

Vol. 3 No. 1 (2026): 2026: Vulnerability Intelligence in Operational Systems

Section

Articles

License

Copyright (c) 2026 The author(s)

Creative Commons License

This work is licensed under a Creative Commons Attribution 4.0 International License.

AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.