CVEs for reachability

Last updated: Oct 26, 2026

Fluid Attacks reports the reachability status at these levels:

• Latent: (a) A vulnerable dependency is declared in the package manager, but (b) no file imports the dependency.
• Potential: (a) A vulnerable dependency is declared in the package manager. (b) The code imports the vulnerable dependency. (c) But the code does not call the vulnerable function of the dependency.
• Reachable: (a) A vulnerable dependency is declared in the package manager. (b) The code imports the vulnerable dependency. (c) And the code calls the vulnerable function of the dependency.

These two technical examples and an analogy help you understand the levels:

Example in JS (Node.js):

package.json

{
  "name": "demo-app",
  "version": "1.0.0",
  "dependencies": {
    "vulnLib": "1.2.3"
  }
}

app.js

// LATENT: Library declared in package.json but not imported nor used

console.log("Hello world");

// POTENTIAL: Library imported but vulnerable function not used

import vulnLib from 'vulnLib',
console.log("Library loaded but dangerous function not used")

// REACHABLE: Library imported and vulnerable function is used

import vulnLib from 'vulnLib',
vulnLib.dangerousFunction(); // <- Risk activated

Example in Python

requirements.txt
vuln-lib==1.2.3

app.py

# LATENT: Library declared in requirements.txt but not imported nor used
print("Hello world")

# POTENTIAL: Library imported but vulnerable function not used
import vuln_lib
print("Library loaded but dangerous function not used")

# REACHABLE: Library imported and vulnerable function is used
import vuln_lib
vuln_lib.dangerousFunction() # <- Risk activated*`

Analogy

• Latent

  1. (a) The book is in the library (declared), but
  2. (b) you do not read any chapter (not imported).

• Potential

  1. (a) The book is in the library (declared),
  2. (b) you start reading any chapter (imported), but
  3. (c) you do not read the faulty chapter.

• Reachable

  1. (a) The book is in the library (declared),
  2. (b) you start reading any chapter (imported), and

  3. (c) you read the faulty chapter and use it as a reference for your MBA thesis.

Supported

Latent and Potential

At the Latent and Potential levels, Fluid Attacks supports all CVEs and other advisories about vulnerable third-party dependencies or libraries. They must be from reliable vulnerability databases and be for the supported languages and package managers. For the list of sources, read Vulnerability signature update.

Reachable

Fluid Attacks has methods to detect when software calls known vulnerable functions reported in specific CVE entries or advisories. The complete and up-to-date list, classified by ecosystem, is in Fluid Attacks' database.

Unsupported

Latent and Potential

At the Latent and Potential levels, Fluid Attacks' testing does not support CVEs or advisories that are not from its supported data sources or not for the supported languages and packages.

Reachable

At the Reachable level, Fluid Attacks' analysis does not support CVEs or advisories for vulnerabilities in software libraries that are not in Fluid Attacks' database.