Vulnerability Proof-of-Concepts in Software Supply Chain: Real-World Usage Scenarios from the Perspective of Migration

Abstract

The security community widely uses software composition analysis (SCA) to identify vulnerabilities introduced by third-party libraries (TPLs) in the software supply chain. However, static analysis produces many false positives, so a Proof-of-Concept (PoC) is needed to confirm that a vulnerability is exploitable. Existing research studies PoC migration for cross-project vulnerability propagation. Propagation across operating systems and hardware architectures has received far less attention, yet each type raises distinct migration requirements and challenges. In this paper, we present three real-world usage scenarios of PoC migration, one for each propagation type: cross-project, cross-OS, and cross-architecture. For each scenario, we analyze its challenges and propose preliminary solutions by synthesizing existing research and empirically analyzing dozens of reproduced PoC cases. We regard the difference between the original and target vulnerability vectors as the mutation that a vulnerability undergoes as it propagates. Building on this view, we reuse an already-verified PoCo as a high-fidelity seed and propose diff-based PoC migration as the preliminary solution. We further discuss how, in the era of large language models (LLMs), an agentic workflow can use LLMs to interpret these differences and to drive the program-analysis tools that adapt the PoC. We hope this work provides a basis for studying real-world PoC migration and for strengthening supply-chain security.