TraceVIC Finds the Vulnerability-Inducing Commit for 78 of 79 CVEs by Reasoning Over a Temporal Code Graph Instead of git blame

arXiv·medium signalXBlueskyLinkedInCopy link

Existing tools for finding the commit that introduced a vulnerability rely on git blame and positional heuristics such as picking the earliest or latest touch. TraceVIC localizes root-cause lines, builds per-revision program graphs joined by temporal edges, and ranks commits by how much they contributed to the vulnerable condition. Modeling the full history raised F2 from 0.637 to 0.814, the method beat prior work by up to 28.7%, and it found a valid inducing commit for 78 of 79 vulnerabilities in four unseen C/C++ projects. It fits security triage agents that need to scope which releases shipped a bug.