Xpsd is a security analysis utility that determines if a reported CVE or vulnerability finding is reachable in a specific source code repository. It processes vulnerability scan reports (e.g., from Grype, Trivy, Snyk) and runs a reachability analysis using a combination of large language models, AST-based code navigation, and advisory data from OSV.dev. The tool outputs structured verdicts, evidence, and SARIF files compatible with GitHub code scanning. It is designed to reduce noise in vulnerability reports by filtering findings that cannot be triggered in the analyzed codebase. Xpsd is open source under the Apache-2.0 license and integrates with GitHub Actions and Copilot. The project does not describe any security vulnerability or exploit but rather provides a tool to improve vulnerability triage.

There is no direct security impact or vulnerability described. Xpsd is a tool intended to assist developers and security teams in assessing the actual risk of vulnerabilities reported in their codebase by determining reachability. It does not introduce a security threat or exploit. No known exploits or malicious activity are associated with Xpsd.

No mitigation is required as this is not a vulnerability or threat. Users interested in vulnerability triage can consider using Xpsd to improve their vulnerability management processes. Since this is a tool, standard security best practices for using third-party software and GitHub Actions should be followed.