A Systematic Review on Detection, Repair, and Explanation of Vulnerabilities in Source Code Using Large Language Models
Lucas Bastos Germano, Ronaldo Ribeiro Goldschmidt, Ricardo Choren Noya, Júlio César Duarte · IEEE Access · 2025
Software vulnerabilities pose critical risks to the security and reliability of modern systems, requiring effective detection, repair, and explanation techniques. Large Language Models (LLMs) have recently emerged as promising tools for these tasks, yet research in this area remains uneven. This systematic review analyzes 208 peer-reviewed studies published between 2018 and August 2025, examining how LLMs are applied to source code vulnerability analysis. The findings reveal a strong emphasis on vulnerability detection (91.3% of studies), while repair (11.1%) and explanation (5.3%) remain underexplored. Programming language coverage shows similar imbalances: C/C++ is the most frequently studied, whereas widely adopted languages such as Java, Python, and JavaScript receive limited attention. Dataset fragmentation further complicates cross-study comparisons, with CodeXGlue/Devign and Big-Vul serving as the most common baselines, but many studies rely on custom or synthetic datasets. Evaluation practices also exhibit limitations, with repair often assessed through strict exact-match metrics and explanations lacking standardized frameworks. Building on these insights, this review maps the use of LLMs across tasks, languages, models, datasets, and metrics, and outlines key directions for future work, including expanding research on underrepresented languages, developing robust evaluation methods, and adopting standardized benchmarks to improve reproducibility and applicability in software security research.