Lulu Zeng

Software vulnerability mining is important for improving software reliability and security. Compared with sequence-based models, graph neural networks (GNNs) can explicitly model program structures such as syntax, control flow, data flow, call relations, and dependency paths, and have therefore been widely studied for vulnerability detection, localization, explanation, and repair. This paper presents a PRISMA-informed structured topical review of 87 studies and addresses five research questions concerning program graph representation, homogeneous and heterogeneous GNN architectures, Graph–LLM integration, evaluation reliability, and future research directions. The reviewed evidence shows that graph-based methods are most effective when vulnerability mechanisms can be faithfully represented through explicit structural relations. However, their reported performance remains strongly affected by duplicated samples, random function-level splits, noisy labels, incomplete repository context, graph-construction errors, and weak explanation protocols. Homogeneous GNNs provide efficient structural message passing but may mix different semantic relations, whereas heterogeneous GNNs preserve relation types more explicitly at the cost of greater graph-quality and computational requirements. Graph–LLM systems can improve semantic reasoning, repository-level analysis, explanation generation, and repair support, but their benefits should be evaluated together with memory consumption, inference latency, deployment complexity, and verification cost. This review further proposes minimum requirements for reliable vulnerability benchmarks and verifiable explanations, and develops a strategic agenda covering leakage-resistant datasets, uncertainty-aware graph construction, repository-level evaluation, cost-effective Graph–LLM collaboration, and graph-guided autonomous vulnerability repair.