SBOM Tools Cover Only the First Two of Four Supply-Chain Propagation Stages

arXiv 2609.05380·medium signalXBlueskyLinkedInCopy link

arXiv 2609.05380 proposes a four-stage propagation model for software supply chain security and empirically evaluates four open-source SBOM tools against each stage using three projects and Log4j as the test case. The tools systematically support only Stage 1 (Structural Exposure) and Stage 2 (Vulnerability Class Presence); Stage 3 (Code Reachability) and Stage 4 (Taint Path Analysis) require capabilities absent from the SBOM ecosystem entirely. The practical read is that an SBOM tells you a vulnerable component is present, not whether it is reachable or exploitable in your build.