Name: Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source Forks With Global History Analysis - Romain Lefeuvre, IRISA, Inria
Start: 2026-10-06T14:57:00+0200
End: 2026-10-06T15:15:00+0200

Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source Forks With Global History Analysis - Romain Lefeuvre, IRISA, Inria

Tuesday October 6, 2026 14:57 - 15:15 CEST

South Hall 3A

Tracking vulnerabilities inherited from third-party open-source software is a well-known challenge, often addressed by tracing the threads of dependency information. At scale, existing approaches precompute the vulnerable versions of software associated with known CVEs, based on declared impacted versions or using local history analysis. However, vulnerabilities can also propagate through forking: a repository forked after a vulnerability is introduced but before it is patched may remain vulnerable long after the original repository has been fixed. Existing history analysis approaches analyze only the repository referenced by the CVE, providing a local view of the ecosystem that excludes forks sharing part of its development history. Vulnerabilities disclosed and patched elsewhere in a fork ecosystem may therefore persist as one-day (known but unpatched) vulnerabilities without fork maintainers’ awareness. This paper proposes a global history analysis approach that conforms to the evaluation semantics defined by the OpenSSF Open Source Vulnerability (OSV) format, while extending them from repository-local histories to the global commit graph of the open-source ecosystem. Leveraging the graph of public code captured by Software Heritage, our approach propagates vulnerability introduction and fix information across shared commit histories and performs automated impact analysis. Starting from 7162 repositories containing vulnerable commits listed in the OSV.dev vulnerability database, we propagate vulnerability information to 2.2 million forks. We evaluate our approach on a sample of 195 ⟨fork, vulnerability⟩ pairs from popular repositories, manually auditing their code and contacting their maintainers for confirmation and responsible disclosure. This process identified 135 high-severity one-day vulnerabilities, achieving a precision of 0.69, with 9 cases confirmed by maintainers.

Speakers

Romain Lefeuvre

PhD Student, IRISA, Inria

Romain Lefeuvre is a PhD student in software engineering at the DiverSE team (IRISA, Inria, University of Rennes), supervised by Professor Benoit Combemale. His research explores how diversity, in open-source ecosystems, in software features, and in development processes, impacts... Read More →

Tuesday October 6, 2026 14:57 - 15:15 CEST
South Hall 3A

SCORED Sessions, Supply Chain Ecosystems

OpenSSF Community Day Europe 2026

Romain Lefeuvre

Get help with the event

OpenSSF Community Day Europe 2026

Romain Lefeuvre

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event