Knowledge-Enhanced Agentic Vulnerability Repair

• URL: http://arxiv.org/abs/2607.00820v1
• Date: Wed, 01 Jul 2026 11:42:25 GMT
• Title: Knowledge-Enhanced Agentic Vulnerability Repair
• Abstract summary: KeaRepair is a novel agentic approach that grounds patch generation in verified program facts and high-level vulnerability knowledge.<n>It significantly outperforms existing approaches on 55 C/C++ vulnerabilities.<n>When paired with Gemini-3.1-Pro, KeaRepair successfully repairs 46 vulnerabilities, achieving a repair rate of 83.64%.
• Score: 20.715227299482947
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Frontier foundation models have changed the math on vulnerability discovery, but the bigger challenge is how the remediation side keeps up. Despite recent progresses in Automated Vulnerability Repair (AVR), current solutions struggle to reliably identify the root causes of vulnerabilities, and insufficiently utilize the prior fix knowledge to guide the patch generation process, thus undermining their effectiveness in practice. To address this gap, we propose KeaRepair, a novel agentic AVR approach that grounds patch generation in verified program facts and high-level vulnerability knowledge. Specifically, KeaRepair first extracts multi-dimensional vulnerability knowledge from historical vulnerability-patch pairs from dual complementary views, and constructs dedicated retrieval knowledge bases. It then employs a tool-augmented agent that performs ReAct-style reasoning to collect verified program facts for vulnerability diagnosis. Finally, based on the diagnostic results, KeaRepair performs knowledge-level retrieval-augmented patch generation and iteratively refines patches through a closed-loop validation process involving compilation, PoC replay, and test-suite execution. Experimental results show that KeaRepair significantly outperforms existing AVR approaches on 55 reproducible C/C++ vulnerabilities. When paired with Gemini-3.1-Pro, KeaRepair successfully repairs 46 vulnerabilities, achieving a repair rate of 83.64%. Moreover, KeaRepair fixes six unique vulnerabilities that none of the baselines can address, and further demonstrates strong cross-language generalizability.

Related papers

• Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale [54.83971397981572]
  Language-model agents increasingly operate over complete software repositories.<n> cybersecurity evaluations measure whether they can detect, reproduce, or repair vulnerabilities rather than whether they can locate the relevant code.<n>We study vulnerability localization: given a weakness class and an unfamiliar repository, identify the implementation files associated with that weakness.
  arXiv  Detail & Related papers  (2026-09-14T17:44:51Z)
• Independent Patch Verification for Coding Agents with a Bidirectional Reconstruct-and-Verify Framework [49.16055123488827]
  coding agents powered by large language models can now generate code patches directly from bug reports.<n>No mechanism independently verifies whether it truly resolves the reported problem.<n>We propose RETRACE, a training-free post-generation verification framework.
  arXiv  Detail & Related papers  (2026-08-09T22:59:13Z)
• PhoenixRepair: Rethinking Repair Strategy Exploration in Software Agents [62.36339598951133]
  We present PhoenixRepair, a multi-agent framework that explores multiple candidate edit locations and generates better patches.<n>PhoenixRepair achieves the largest relative improvement of 7.8% over SWE-agent under DeepSeek-V3.1, and attains the highest resolved rate of 76.0% Pass@1 under MiniMax-M2.5.
  arXiv  Detail & Related papers  (2026-07-21T08:49:30Z)
• RAVEN: Agentic RAG for Automated Vulnerability Repair [48.8954115363348]
  We propose RAVEN, a scalable, efficient and autonomous framework for automated vulnerability repair.<n>RAVEN integrates an agentic retrieval-augmented generation (RAG) pipeline with controlled iterative repair in a unified framework.<n>RAVEN achieves an overall repair success rate of 83.13%, outperforming all existing state-of-the-art repair frameworks.
  arXiv  Detail & Related papers  (2026-06-21T19:18:06Z)
• MemRepair: Hierarchical Memory for Agentic Repository-Level Vulnerability Repair [10.709112246848058]
  Modern software ecosystems face a rapidly growing number of disclosed vulnerabilities.<n>Most existing systems treat vulnerability repair as a single generation step over the currently visible code context.<n>We present MemRepair, a memoryaugmented agentic framework that formulates vulnerability repair as an iterative, experience-driven process.
  arXiv  Detail & Related papers  (2026-05-17T13:29:46Z)
• Multi-Agent End-to-End Vulnerability Management for Mitigating Recurring Vulnerabilities [9.2997229083124]
  Traditional static analysis methods struggle to precisely capture contextual dependencies.<n> recurring vulnerabilities emerge repeatedly due to code reuse and shared logic.<n>We present MAVM, a multi-agent framework for end-to-end recurring vulnerability management.
  arXiv  Detail & Related papers  (2026-01-25T09:35:05Z)
• Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework [15.17681731375364]
  SeCuRepair is a semantics-aligned, curriculum-driven, and reasoning-enhanced framework for vulnerability repair.<n>At its core, SeCuRepair adopts a reason-then-edit paradigm, requiring the model to articulate why and how a vulnerability should be fixed.<n>SeCuRepair also moves beyond traditional supervised fine-tuning and employs semantics-aware reinforcement learning.
  arXiv  Detail & Related papers  (2025-10-01T15:09:27Z)
• Scalable and Robust LLM Unlearning by Correcting Responses with Retrieved Exclusions [49.55618517046225]
  Language models trained on web-scale corpora risk memorizing and exposing sensitive information.<n>We propose Corrective Unlearning with Retrieved Exclusions (CURE), a novel unlearning framework.<n>CURE verifies model outputs for leakage and revises them into safe responses.
  arXiv  Detail & Related papers  (2025-09-30T09:07:45Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• Agent KB: Leveraging Cross-Domain Experience for Agentic Problem Solving [62.71545696485824]
  We introduce AGENT KB, a universal memory infrastructure enabling seamless experience sharing across heterogeneous agent frameworks without retraining.<n>AGENT KB aggregates trajectories into a structured knowledge base and serves lightweight APIs.<n>We validate AGENT across major frameworks on GAIA, Humanity's Last Exam, GPQA, and SWE-bench.
  arXiv  Detail & Related papers  (2025-07-08T17:59:22Z)
• InfraFix: Technology-Agnostic Repair of Infrastructure as Code [46.798266975184276]
  InfraFix is the first technology-agnostic framework for repairing IaC scripts.<n>We demonstrate its effectiveness across 254,288 repair scenarios with a success rate of 95.7%.
  arXiv  Detail & Related papers  (2025-03-21T15:24:54Z)
• CommitShield: Tracking Vulnerability Introduction and Fix in Version Control Systems [15.037460085046806]
  CommitShield is a tool for detecting vulnerabilities in code commits.<n>It combines the code analysis capabilities of static analysis tools with the natural language and code understanding capabilities of large language models.<n>We show that CommitShield improves recall by 76%-87% over state-of-the-art methods in the vulnerability fix detection task.
  arXiv  Detail & Related papers  (2025-01-07T08:52:55Z)
• There are More Fish in the Sea: Automated Vulnerability Repair via Binary Templates [4.907610470063863]
  We propose a template-based automated vulnerability repair approach for Java binaries.<n>Experiments on the Vul4J dataset demonstrate that TemVUR successfully repairs 11 vulnerabilities.<n>To assess the generalizability of TemVUR, we curate the ManyVuls4J dataset.
  arXiv  Detail & Related papers  (2024-11-27T06:59:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.