{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T09:12:00Z","timestamp":1790154720909,"version":"4.0.1"},"publisher-location":"Singapore","reference-count":46,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819257362","type":"print"},{"value":"9789819257379","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T00:00:00Z","timestamp":1790208000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T00:00:00Z","timestamp":1790208000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2027]]},"DOI":"10.1007\/978-981-92-5737-9_5","type":"book-chapter","created":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T08:57:35Z","timestamp":1790153855000},"page":"89-107","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Vul4Py: Benchmarking Automated Vulnerability Repair in Python with Paired Exploit and Functional Oracles"],"prefix":"10.1007","author":[{"given":"Tan","family":"Bui","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ting","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ferdian","family":"Thung","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yunpeng","family":"Xiong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Penghao","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xin","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Lo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,24]]},"reference":[{"key":"5_CR1","doi-asserted-by":"publisher","unstructured":"Alfadel, M., Costa, D.E., Shihab, E.: Empirical analysis of security vulnerabilities in python packages. Empirical Softw. Engg. 28(3) (2023). https:\/\/doi.org\/10.1007\/s10664-022-10278-4","DOI":"10.1007\/s10664-022-10278-4"},{"key":"5_CR2","unstructured":"Anthropic: Introducing the model context protocol (MCP) (2024). https:\/\/www.anthropic.com\/news\/model-context-protocol. Accessed 02 June 2026"},{"key":"5_CR3","doi-asserted-by":"crossref","unstructured":"Bhandari, G., Naseer, A., Moonen, L.: CVEfixes: automated collection of vulnerabilities and their fixes from open-source software. In: Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering, pp. 30\u201339 (2021)","DOI":"10.1145\/3475960.3475985"},{"issue":"1","key":"5_CR4","doi-asserted-by":"publisher","first-page":"147","DOI":"10.1109\/TSE.2022.3147265","volume":"49","author":"Z Chen","year":"2022","unstructured":"Chen, Z., Kommrusch, S., Monperrus, M.: Neural transfer learning for repairing security vulnerabilities in c code. IEEE Trans. Software Eng. 49(1), 147\u2013165 (2022)","journal-title":"IEEE Trans. Software Eng."},{"key":"5_CR5","doi-asserted-by":"crossref","unstructured":"Fan, J., Li, Y., Wang, S., Nguyen, T.N.: A c\/c++ code vulnerability dataset with code changes and CVE summaries. In: Proceedings of the 17th International Conference on Mining Software Repositories, pp. 508\u2013512 (2020)","DOI":"10.1145\/3379597.3387501"},{"key":"5_CR6","doi-asserted-by":"crossref","unstructured":"Feng, Z., et al.: CodeBERT: a pre-trained model for programming and natural languages. arXiv preprint arXiv:2002.08155 (2020)","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"key":"5_CR7","doi-asserted-by":"crossref","unstructured":"Fu, M., Tantithamthavorn, C., Le, T., Nguyen, V., Phung, D.: VulRepair: a t5-based automated software vulnerability repair. In: Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 935\u2013947 (2022)","DOI":"10.1145\/3540250.3549098"},{"key":"5_CR8","doi-asserted-by":"crossref","unstructured":"Gao, X., Mechtaev, S., Roychoudhury, A.: Crash-avoiding program repair. In: Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 8\u201318 (2019)","DOI":"10.1145\/3293882.3330558"},{"issue":"2","key":"5_CR9","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3418461","volume":"30","author":"X Gao","year":"2021","unstructured":"Gao, X., Wang, B., Duck, G.J., Ji, R., Xiong, Y., Roychoudhury, A.: Beyond tests: program vulnerability repair via crash constraint extraction. ACM Trans. Software Eng. Methodol. (TOSEM) 30(2), 1\u201327 (2021)","journal-title":"ACM Trans. Software Eng. Methodol. (TOSEM)"},{"key":"5_CR10","unstructured":"GitHub: Octoverse 2024: AI leads python to the top language as the number of global developers surges (2024). https:\/\/github.blog\/news-insights\/octoverse\/octoverse-2024\/. Accessed 02 June 2026"},{"key":"5_CR11","unstructured":"Google: OSV: Open Source Vulnerabilities (2024). https:\/\/osv.dev. Accessed 02 June 2026"},{"key":"5_CR12","unstructured":"Hu, Y., et al.: $$\\{$$SoK$$\\}$$: automated vulnerability repair: methods, tools, and assessments. In: 34th USENIX Security Symposium (USENIX Security 25), pp. 4421\u20134440 (2025)"},{"key":"5_CR13","doi-asserted-by":"publisher","first-page":"103917","DOI":"10.1016\/j.csi.2024.103917","volume":"92","author":"RA Husein","year":"2025","unstructured":"Husein, R.A., Aburajouh, H., Catal, C.: Large language models for code completion: a systematic literature review. Comput. Stand. Interfaces 92, 103917 (2025)","journal-title":"Comput. Stand. Interfaces"},{"issue":"1","key":"5_CR14","doi-asserted-by":"publisher","first-page":"54","DOI":"10.1109\/TSE.2011.104","volume":"38","author":"C Le Goues","year":"2011","unstructured":"Le Goues, C., Nguyen, T., Forrest, S., Weimer, W.: GenProg: a generic method for automatic software repair. IEEE Trans. Software Eng. 38(1), 54\u201372 (2011)","journal-title":"IEEE Trans. Software Eng."},{"key":"5_CR15","doi-asserted-by":"crossref","unstructured":"Li, Y., et al.: Out of distribution, out of luck: how well can LLMs trained on vulnerability datasets detect top 25 CWE weaknesses? arXiv preprint arXiv:2507.21817 (2025)","DOI":"10.1145\/3744916.3787830"},{"key":"5_CR16","unstructured":"Li, Y., Hossain Shezan, F., Wei, B., Wang, G., Tian, Y.: SoK: towards effective automated vulnerability repair. In: 34th USENIX Security Symposium (USENIX Security 25), pp. 4441\u20134462 (2025)"},{"key":"5_CR17","doi-asserted-by":"crossref","unstructured":"Mell, P., Bojanova, I., Galhardo, C.: Measuring the exploitation of weaknesses in the wild. arXiv preprint arXiv:2405.01289 (2024)","DOI":"10.1109\/MITP.2024.3399485"},{"key":"5_CR18","unstructured":"Nong, Y., Yang, H., Cheng, L., Hu, H., Cai, H.: APPATCH: automated adaptive prompting large language models for real-world software vulnerability patching. In: 34th USENIX Security Symposium (USENIX Security 25), pp. 4481\u20134500 (2025)"},{"key":"5_CR19","doi-asserted-by":"crossref","unstructured":"Paleyes, A., Sendyka, R., Robinson, D., Cabrera, C., Lawrence, N.D.: Prompt variability effects on LLM code generation. arXiv preprint arXiv:2506.10204 (2025)","DOI":"10.1145\/3786181.3788724"},{"key":"5_CR20","doi-asserted-by":"crossref","unstructured":"Pearce, H., Tan, B., Ahmad, B., Karri, R., Dolan-Gavitt, B.: Examining zero-shot vulnerability repair with large language models. In: 2023 IEEE Symposium on Security and Privacy (SP), pp. 2339\u20132356. IEEE (2023)","DOI":"10.1109\/SP46215.2023.10179324"},{"issue":"140","key":"5_CR21","first-page":"1","volume":"21","author":"C Raffel","year":"2020","unstructured":"Raffel, C., et al.: Exploring the limits of transfer learning with a unified text-to-text transformer. J. Mach. Learn. Res. 21(140), 1\u201367 (2020)","journal-title":"J. Mach. Learn. Res."},{"key":"5_CR22","unstructured":"Risse, N., B\u00f6hme, M.: Uncovering the limits of machine learning for automatic vulnerability detection. In: 33rd USENIX Security Symposium (USENIX Security 24) (2024)"},{"key":"5_CR23","doi-asserted-by":"crossref","unstructured":"Schick, T., et al.: ToolFormer: language models can teach themselves to use tools. In: Advances in Neural Information Processing Systems, vol. 36, pp. 68539\u201368551 (2023)","DOI":"10.52202\/075280-2997"},{"issue":"4","key":"5_CR24","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3707454","volume":"34","author":"R Shariffdeen","year":"2025","unstructured":"Shariffdeen, R., Timperley, C.S., Noller, Y., Le Goues, C., Roychoudhury, A.: Vulnerability repair via concolic execution and code mutations. ACM Trans. Software Eng. Methodol. 34(4), 1\u201327 (2025)","journal-title":"ACM Trans. Software Eng. Methodol."},{"key":"5_CR25","doi-asserted-by":"crossref","unstructured":"Shinn, N., Cassano, F., Gopinath, A., Narasimhan, K., Yao, S.: Reflexion: language agents with verbal reinforcement learning. In: Advances in Neural Information Processing Systems, vol. 36, pp. 8634\u20138652 (2023)","DOI":"10.52202\/075280-0377"},{"key":"5_CR26","unstructured":"Stack Overflow: Stack overflow developer survey 2025 (2025). https:\/\/survey.stackoverflow.co\/2025\/. Accessed 02 June 2026"},{"key":"5_CR27","unstructured":"Sun, W., et al.: Source code summarization in the era of large language models. arXiv preprint arXiv:2407.07959 (2024)"},{"key":"5_CR28","unstructured":"Team, T.R., et al.: Trae agent: an LLM-based agent for software engineering with test-time scaling (2025). https:\/\/arxiv.org\/abs\/2507.23370"},{"key":"5_CR29","unstructured":"TIOBE Software BV: TIOBE index (2025). https:\/\/www.tiobe.com\/tiobe-index\/. Accessed 02 June 2026"},{"key":"5_CR30","doi-asserted-by":"crossref","unstructured":"Wang, P., Liu, X., Xiao, C.: CVE-bench: benchmarking LLM-based software engineering agent\u2019s ability to repair real-world CVE vulnerabilities. In: Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 4207\u20134224 (2025)","DOI":"10.18653\/v1\/2025.naacl-long.212"},{"key":"5_CR31","unstructured":"Wang, W., et al.: VulnRepairEval: an exploit-based evaluation framework for assessing large language model vulnerability repair capabilities. arXiv preprint arXiv:2509.03331 (2025)"},{"key":"5_CR32","doi-asserted-by":"crossref","unstructured":"Wang, X., Wang, S., Feng, P., Sun, K., Jajodia, S.: PatchDB: a large-scale security patch dataset. In: DSN (2021)","DOI":"10.1109\/DSN48987.2021.00030"},{"key":"5_CR33","unstructured":"Wang, X., et al.: Openhands: an open platform for AI software developers as generalist agents. arXiv preprint arXiv:2407.16741 (2024)"},{"key":"5_CR34","unstructured":"Wei, Z., et al.: PATCHEVAL: a new benchmark for evaluating LLMs on patching real-world vulnerabilities. arXiv preprint arXiv:2511.11019 (2025)"},{"key":"5_CR35","unstructured":"Weyssow, M., et al.: R2Vul: learning to reason about software vulnerabilities with reinforcement learning and structured reasoning distillation. arXiv preprint arXiv:2504.04699 (2025)"},{"key":"5_CR36","doi-asserted-by":"crossref","unstructured":"Widyasari, R., et al.: BugsInPy: a database of existing bugs in python programs to enable controlled testing and debugging studies. In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 1556\u20131560 (2020)","DOI":"10.1145\/3368089.3417943"},{"key":"5_CR37","unstructured":"Xiong, Y., Zhang, T.: Sifting the noise: a comparative study of LLM agents in vulnerability false positive filtering. arXiv preprint arXiv:2601.22952 (2026)"},{"key":"5_CR38","doi-asserted-by":"crossref","unstructured":"Yang, C., et al.: SeCurePair: semantics-aligned, curriculum-driven, and reasoning-enhanced vulnerability repair framework. In: Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 32108\u201332123 (2026)","DOI":"10.18653\/v1\/2026.acl-long.1481"},{"key":"5_CR39","doi-asserted-by":"crossref","unstructured":"Yang, J., et al.: Swe-agent: agent-computer interfaces enable automated software engineering. In: Advances in Neural Information Processing Systems, vol. 37, pp. 50528\u201350652 (2024)","DOI":"10.52202\/079017-1601"},{"key":"5_CR40","unstructured":"Yao, S., et al.: React: synergizing reasoning and acting in language models. In: The Eleventh International Conference on Learning Representations (2022)"},{"key":"5_CR41","unstructured":"Zhang, Q., et al.: A systematic literature review on large language models for automated program repair. arXiv preprint arXiv:2405.01466 (2024)"},{"issue":"3","key":"5_CR42","first-page":"1","volume":"34","author":"T Zhang","year":"2025","unstructured":"Zhang, T., Irsan, I.C., Thung, F., Lo, D.: Revisiting sentiment analysis for software engineering in the era of large language models. ACM Trans. Software Eng. Methodol. 34(3), 1\u201330 (2025)","journal-title":"ACM Trans. Software Eng. Methodol."},{"key":"5_CR43","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Gao, X., Duck, G.J., Roychoudhury, A.: Program vulnerability repair via inductive inference. In: Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 691\u2013702 (2022)","DOI":"10.1145\/3533767.3534387"},{"issue":"5","key":"5_CR44","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3708522","volume":"34","author":"X Zhou","year":"2025","unstructured":"Zhou, X., Cao, S., Sun, X., Lo, D.: Large language model for vulnerability detection and repair: literature review and the road ahead. ACM Trans. Software Eng. Methodol. 34(5), 1\u201331 (2025)","journal-title":"ACM Trans. Software Eng. Methodol."},{"key":"5_CR45","doi-asserted-by":"crossref","unstructured":"Zhou, X., Kim, K., Xu, B., Han, D., Lo, D.: Out of sight, out of mind: better automatic vulnerability repair by broadening input ranges and sources. In: Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering, pp. 1\u201313 (2024)","DOI":"10.1145\/3597503.3639222"},{"key":"5_CR46","doi-asserted-by":"crossref","unstructured":"Zhou, X., Zhang, T., Lo, D.: Large language model for vulnerability detection: emerging results and future directions. In: Proceedings of the 2024 ACM\/IEEE 44th International Conference on Software Engineering: New Ideas and Emerging Results, pp. 47\u201351 (2024)","DOI":"10.1145\/3639476.3639762"}],"container-title":["Lecture Notes in Computer Science","Provable and Practical Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-92-5737-9_5","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,23]],"date-time":"2026-09-23T08:57:59Z","timestamp":1790153879000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-92-5737-9_5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,24]]},"ISBN":["9789819257362","9789819257379"],"references-count":46,"URL":"https:\/\/doi.org\/10.1007\/978-981-92-5737-9_5","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,24]]},"assertion":[{"value":"24 September 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ProvSec","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Provable Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Queenstown","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"New Zealand","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24 September 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 September 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"provsec2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/provsec-2026.github.io\/Provsec2026-base\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}