Recovering Vulnerability Conditions from Multi-Source Evidence: Repair Semantics and Uncertainty-Aware Reasoning for Open-Source Components

Open-source vulnerability evidence is distributed across vulnerability databases, project advisories, version records, code repositories, issue/PR threads, proofs of concept, and tests. These artifacts may share upstream sources, apply to different scopes, or contain inconsistent conclusions, while security fixes may evolve through backports, follow-up fixes, bypass fixes, and cross-branch variants. This paper investigates a multi-source evidence-driven framework for representing and recovering vulnerability conditions in open-source components. The method normalizes heterogeneous artifacts into provenance-, time-, and scope-anchored atomic claims, constructs patch families to recover scope-aware fix invariants, and applies temporal–scope constraints to model evolutionary supersession, alternative triggers, and genuine conflicts while preserving Unknown or Conflict states. We conduct a mechanism-oriented evaluation on 75 real vulnerabilities with traceable project-side evidence from the Maven, PyPI, and Go ecosystems. The complete framework does not outperform simpler baselines on overall condition recovery or demonstrate a consistent advantage in fix-invariant recovery. On cases containing Unknown conditions, abstention reduces Unknown-to-Known errors at the cost of determinate coverage; patch-relation and genuine-Conflict recovery remain unsuccessful in the present evaluation. The results characterize the limits of the current framework and identify specific trade-offs and unresolved requirements for evidence-grounded repair and uncertainty reasoning.