Reachable — exploitability-aware vulnerability triage

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

Inspiration

You switch on dependency scanning and it finds 100+ CVEs. Which do you fix first? You can't tell — so you fix none, and the one that's actually exploitable hides in the noise. Reachability analysis fixes this, but it's a premium feature because it needs a whole-program call graph.

What it does

Reachable reuses GitLab Orbit as that call graph. For each dependency-scan finding it asks Orbit: is this package actually called along a path from a real entry point? It keeps only the reachable ones, grades them by severity (with the call path shown), separates framework CVEs from library CVEs, and drafts a remediation merge request per reachable package.

On OWASP PyGoat with real OSV CVEs: 101 findings → 19 reachable → 4 ready-to-merge MRs (52 framework + 39 noise filtered). PyYAML's RCE is shown reachable via a Django view; cryptography / urllib3 / idna are dropped as never-imported.

How we built it

A Python engine over Orbit Local (the open-source orbit CLI, DuckDB). The core does a reverse-BFS from each vulnerable call site up the call graph to a real entry point. Findings come from GitLab Dependency Scanning; the demo dataset is generated from live OSV.dev data. Shipped as three artifacts: an Orbit reachability Agent Skill, the Reachable flow (published to the AI Catalog), and the engine + CLI (34 tests).

How it uses GitLab Orbit

The whole product is one Orbit query pattern made useful — Orbit's CALLS Definition→ImportedSymbol and Definition→Definition edges, queried via orbit sql / MCP, compute reachability. Nobody markets Orbit as a security tool; we reveal it as a reachability engine.

Challenges

Scoping reachability honestly (usage-based: import + call path from an entry point, not tracing into library internals), mapping PyPI names to import names, and choosing sane fix versions from messy OSV ranges.

What's next

Hosted Orbit SDLC tier ("EXPLOITABLE IN PROD" via deployment edges), more languages, and symbol-level reachability when an advisory names the vulnerable function.