Skip to content

Autonomous reproduction · GHSA/CVE → runnable proof

A CVE tells you there's a vulnerability.
Pruva shows you it firing.

Every published GHSA and CVE, autonomously reproduced in a sandbox — each with a runnable script, a session replay, and a permanent REPRO-YYYY-NNNNN identifier. Run pruva-verify and see it for yourself.

Browse Reproductions View Stats
pruva · REPRO-2026-00186 · libssh2 via curl PROVEN
$ pruva-verify REPRO-2026-00186
fetching reproduction script… isolated sandbox ready
building curl against libssh2 1.11.0 · spawning AsyncSSH peer
running reproduction_steps.sh
Segmentation fault — libssh2 packet length parser
exit 139 · libssh2 packet parser crash · reproduces 3/3
VERIFIED — reproduced in a clean sandbox.
245 Reproductions
39 Ecosystems
41m 55s Avg. Duration
$3.62 Median Spend (216/245)
100% Autonomous

How it works

Advisory to runnable proof, autonomously.

01

Analyze the advisory

An AI agent reads the GHSA or CVE, pulls the vulnerable package, and understands the vulnerability's root cause.

02

Reproduce in a sandbox

The agent builds a faithful copy of the affected software and fires the exploit, capturing the crash, the leak, or the shell.

03

Publish verifiable proof

A self-contained script, a session replay, and a permanent REPRO ID. Run pruva-verify to see it fire yourself.

Latest

Verified Reproductions

View all
REPRO-2026-00344 published

MikroTik RouterOS CVE-2026-67279 + CVE-2026-86060 unauthenticated privileged command-execution chain

CVE-2026-67279 high Security Known vulnerability
MikroTik RouterOS SSH
326m 3s Sep 7, 2026
REPRO-2026-00343 published

Jenkins XStream deserialization of nested PersistenceRoot objects leads to RCE via Stapler (SECURITY-3972)

CVE-2026-84645 high Security Vulnerable-path variant Known vulnerability github
jenkinsci/jenkins
44m 4s Sep 3, 2026
REPRO-2026-00342 published

Langflow contains an unauthenticated remote code execution vulnerability in the validate endpoint that can lead to arbitrary Python code execution as root.

CVE-2026-0768 critical Security Known vulnerability PyPI
langflow-ai/langflow
63m 8s Sep 2, 2026
REPRO-2026-00341 published

JFrog Artifactory critical unauthenticated authentication bypass leading to administrative takeover

CVE-2026-82329 critical Security Vulnerable-path variant Known vulnerability
JFrog Artifactory
145m 14s Sep 1, 2026
REPRO-2026-00340 published

PaperCut NG/MF CVE-2026-81578 + CVE-2026-82078 unauthenticated RCE chain

CVE-2026-81578 critical Security Known vulnerability vendor
PaperCut NG/MF
163m 48s Aug 31, 2026
REPRO-2026-00339 published

bubblewrap: sandbox escape via /oldroot symlink traversal during setup — files created on host

GHSA-PXHW-H44J-8PFX high Security Known vulnerability
bubblewrap
18m 28s Aug 26, 2026

The identifier

Why REPRO IDs?

Verified Proof

Each reproduction includes executable scripts, session replays, and before/after evidence proving the vulnerability exists.

Permanent Citation

REPRO IDs are permanent, citable references. Link CVEs, GHSAs, and issues to verified reproductions.

Full Transparency

Watch session replays showing exactly how the agent reproduced the issue. Nothing hidden, everything auditable.

Cite it

Embed in Your README

Show that your security advisory has been independently verified with an embeddable badge.

PRUVA REPRO-2026-00001 
[![Reproduced by Pruva](https://api.pruva.dev/v1/reproductions/REPRO-2026-00001/badge.svg)](https://www.pruva.dev/reproductions/REPRO-2026-00001)

Don't take the advisory's word for it. Run it.

Browse the full catalog of autonomously reproduced vulnerabilities — each with a runnable proof and a permanent REPRO ID.

Browse All Reproductions →