NewsPublished 3 Aug 2026

Xpsd: decide if a CVE is actually reachable in your tree (SARIF / GitHub code scanning)

Source Reddit NetSec

Discussion

Xpsd is an open-source tool designed to analyze whether reported CVEs or vulnerability scan findings are actually reachable in a given source code tree. It integrates with GitHub code scanning and uses an LLM-driven approach combined with structural code navigation and advisory lookups to provide verdicts on vulnerability reachability. The tool helps developers prioritize which vulnerabilities pose real risks in their codebase by providing evidence, call paths, and SARIF reports. It supports multiple vulnerability report formats and can be integrated into CI workflows. There is no indication that Xpsd itself is a vulnerability or threat.

r/netsec (opens in a new tab)u/Emergency_Stable_9230 points0 comments

If you have ever opened a Grype/Trivy report and thought "cool, 200 findings, which ones can actually be hit in this codebase?", that is basically why we built Xpsd.

You feed it a CVE or a scan report. It tries to answer a simpler question: is the vulnerable code reachable here? You get a verdict, some evidence, a call path when it can find one, and SARIF so it shows up in GitHub code scanning next to everything else.

It does not shove your whole repo into an LLM. The agent pokes around with tools (search, advisory lookup, pulling a dep when it has to). Works as a GitHub Action, Copilot or your own model.

Just hit v1.0. Open source, Apache-2.0:

https://github.com/ByteRay-AI/Xpsd

Links cited in the discussion

https://github.com/ByteRay-AI/Xpsd

Impact

There is no direct security impact or vulnerability described. Xpsd is a tool intended to assist developers and security teams in assessing the actual risk of vulnerabilities reported in their codebase by determining reachability. It does not introduce a security threat or exploit. No known exploits or malicious activity are associated with Xpsd.

Defensive guidance

No mitigation is required as this is not a vulnerability or threat. Users interested in vulnerability triage can consider using Xpsd to improve their vulnerability management processes. Since this is a tool, standard security best practices for using third-party software and GitHub Actions should be followed.

Summary

Xpsd is a security analysis utility that determines if a reported CVE or vulnerability finding is reachable in a specific source code repository. It processes vulnerability scan reports (e.g., from Grype, Trivy, Snyk) and runs a reachability analysis using a combination of large language models, AST-based code navigation, and advisory data from OSV.dev. The tool outputs structured verdicts, evidence, and SARIF files compatible with GitHub code scanning. It is designed to reduce noise in vulnerability reports by filtering findings that cannot be triggered in the analyzed codebase. Xpsd is open source under the Apache-2.0 license and integrates with GitHub Actions and Copilot. The project does not describe any security vulnerability or exploit but rather provides a tool to improve vulnerability triage.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 3 Aug 2026, 20:02 UTC

Technical details

References

Community reviews

Related threats