# Korea University's GANADI traces open-source code reuse, cutting vulnerability review by about 90%

- Published: 2026-11-06 03:52 UTC
- Section: Digital & Computing › Data security
- Tags: GANADI, open-source code reuse, software supply chain security, Korea University, CENTRIS, Redis Lua vulnerability, SBOM, ASE 2026, C/C++ GitHub projects
- URL: https://realtech.media/news/rt-d4e10c6fc28120bd016f8222_korea_university_s/

**Researchers at Korea University built GANADI, a tool that reconstructs which projects open-source code passed through, and tested it on 2,500 C/C++ projects from GitHub.**

![Korea University's GANADI traces open-source code reuse, cutting vulnerability review by about 90%](https://sgzwpqqelzmajkcubgkl.supabase.co/storage/v1/object/public/rt-media/2026/11/3fbd95232618a512.jpg)
*Dinkun Chen, Wikimedia Commons, CC BY-SA 4.0*

A research team led by professors Lee Heejo and Woo Seunghoon of the Department of Computer Science at Korea University has developed GANADI, a method that reconstructs the hidden lineage of reused open-source code, dailysmart.co.kr reports. The university announced the result on the 6th. The work was accepted to ASE 2026, the IEEE/ACM International Conference on Automated Software Engineering, and presented on October 15 in Munich, Germany [1].

## How GANADI traces code reuse

Most modern software is assembled from modified open-source code. A vulnerability fixed in the original can therefore remain in other programs, and new ones can appear along the way. Tracing how far a flaw has spread is hard because code passes through several projects. According to the team, its earlier tool CENTRIS identified open-source components inside individual programs, while GANADI also traces the specific projects the code passed through [1].

## Results on GitHub projects

The team collected and analyzed 2,500 major C/C++ projects on GitHub and applied GANADI to an existing vulnerability detection technique. Instead of reviewing loosely related vulnerability reports, the approach selected only those from projects linked by actual code-reuse paths. This reduced the review scope by about 90% [1].

In one case, a vulnerability that arose when Redis took and modified source code of the Lua programming language propagated to other software reusing that code [1]. The researchers also found and reported 48 previously unknown or unresolved vulnerabilities in real open-source projects. Of these, 23 were fixed quickly [1].

Lee said the team intends to link the work with SBOM technology, which records software composition. On October 9, Lee was also selected for the Okawa Foundation's 2026 overseas research grant for a project on SBOM technology for a secure supply chain. The foundation chose 16 researchers from four countries this year [1].

## Sources

1. [dailysmart.co.kr](https://www.dailysmart.co.kr/news/articleView.html?idxno=132131)

---

Source: RealTech, realtech.media — https://realtech.media/news/rt-d4e10c6fc28120bd016f8222_korea_university_s/