• Sujal Walanj
• Ankit Javeri

Modern software applications increasingly rely on third-party and open-source software components, making software supply chain security an important area of cybersecurity. Software Bill of Materials (SBOM) and dependency-based vulnerability management tools are commonly used to identify software components and match them with known vulnerabilities. However, traditional approaches primarily focus on determining whether a vulnerable component and version are present within an application. The presence of a vulnerable library does not necessarily indicate that the vulnerable functionality is actually used or reachable by the application. This research proposes an AST-Based Vulnerability Reachability Analysis approach to provide additional context for software supply chain vulnerability management. The proposed system combines dependency and SBOM information with Abstract Syntax Tree (AST)-based source code analysis. The system identifies third-party components and associated vulnerability information, analyzes Python source code to extract imported libraries, function calls, and API calls, and compares detected calls with known vulnerable APIs. Based on this comparison, vulnerabilities are classified as reachable or unreachable within the scope of the analyses source code. Reachable vulnerabilities are assigned higher priority, while vulnerabilities for which the mapped vulnerable API is not detected are assigned lower priority.

Software Supply Chain Security, Software Bill of Materials (SBOM), Abstract Syntax Tree (AST), Vulnerability Reachability, CVE, Vulnerability Management, Static Analysis, Vulnerability Prioritization

"Moving Beyond Static Inventories: AST-Based Vulnerability Reachability Analysis for Software Supply Chain Security", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.13, Issue 9, page no.d52-d59, September-2026, Available :http://www.jetir.org/papers/JETIR2609307.pdf

"Moving Beyond Static Inventories: AST-Based Vulnerability Reachability Analysis for Software Supply Chain Security", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.13, Issue 9, page no. ppd52-d59, September-2026, Available at : http://www.jetir.org/papers/JETIR2609307.pdf