# SoK: Automated Vulnerability Repair: Methods, Tools, and Assessments

arXiv: https://arxiv.org/abs/2506.11697 · HTML: https://mlsanity.com/paper/2506.11697/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Jun 2025.

## Built on by (most cited first, 12 of 12)

- [CVE-Factory: Scaling Expert-Level Agentic Tasks for Code Security Vulnerability](https://mlsanity.com/paper/2602.03012/) (2026)
- [EviACT: An Evidence-to-Action Framework for Agentic Program Repair](https://mlsanity.com/paper/2605.27238/) (2026)
- [PatchIsland: Orchestration of LLM Agents for Continuous Vulnerability Repair](https://mlsanity.com/paper/2601.17471/) (2026)
- [PatchBench: Evaluating AI Agents for Vulnerability Patching](https://mlsanity.com/paper/2609.04075/) (2026)
- [Why LLMs Fail: A Failure Analysis and Partial Success Measurement for Automated Security Patch Generation](https://mlsanity.com/paper/2603.10072/) (2026)
- [MCP-in-SoS: Risk assessment framework for open-source MCP servers](https://mlsanity.com/paper/2603.10194/) (2026)
- [Beyond Refusal: A Same-Lineage Study of Aligned and Abliterated LLMs for Vulnerability Analysis](https://mlsanity.com/paper/2607.05842/) (2026)
- [MemRepair: Hierarchical Memory for Agentic Repository-Level Vulnerability Repair](https://mlsanity.com/paper/2605.17444/) (2026)
- [ContraFix: Skill-Enhanced Contrastive Runtime Analysis for Vulnerability Repair](https://mlsanity.com/paper/2605.17450/) (2026)
- [SoK: AI Secure Code Generation: Progress, Pitfalls, and Paths Forward](https://mlsanity.com/paper/2606.25195/) (2026)
- [Knowledge-Enhanced Agentic Vulnerability Repair](https://mlsanity.com/paper/2607.00820/) (2026)
- [P2Patch: Exploit-Guided Vulnerability Repair](https://mlsanity.com/paper/2610.20245/) (2026)

## Abstract (arXiv)

The increasing complexity of software has led to the steady growth of vulnerabilities. Vulnerability repair investigates how to fix software vulnerabilities. Manual vulnerability repair is labor-intensive and time-consuming because it relies on human experts, highlighting the importance of Automated Vulnerability Repair (AVR). In this SoK, we present the systematization of AVR methods through the three steps of AVR workflow: vulnerability analysis, patch generation, and patch validation. We assess AVR tools for C/C++ and Java programs as they have been widely studied by the community. Since existing AVR tools for C/C++ programs are evaluated with different datasets, which often consist of a few vulnerabilities, we construct the first C/C++ vulnerability repair benchmark dataset, dubbed Vul4C, which contains 144 vulnerabilities as well as their exploits and patches. We use Vul4C to evaluate seven AVR tools for C/C++ programs and use the third-party Vul4J dataset to evaluate two AVR tools for Java programs. We also discuss future research directions.