Autonomous reproduction · GHSA/CVE → runnable proof

A CVE tells you there's a vulnerability.
Pruva shows you it firing.

Every published GHSA and CVE, autonomously reproduced in a sandbox — each with a runnable script, a session replay, and a permanent REPRO-YYYY-NNNNN identifier. Run pruva-verify and see it for yourself.

Browse Reproductions View Stats

pruva · REPRO-2026-00186 · libssh2 via curl PROVEN

$ pruva-verify REPRO-2026-00186

fetching reproduction script… isolated sandbox ready

building curl against libssh2 1.11.0 · spawning AsyncSSH peer

running reproduction_steps.sh

Segmentation fault — libssh2 packet length parser

exit 139 · libssh2 packet parser crash · reproduces 3/3

VERIFIED — reproduced in a clean sandbox.

197 Reproductions

32 Ecosystems

33m 11s Avg. Duration

$2.74 Median Spend (168/197)

100% Autonomous

How it works

Advisory to runnable proof, autonomously.

Analyze the advisory

An AI agent reads the GHSA or CVE, pulls the vulnerable package, and understands the vulnerability's root cause.

Reproduce in a sandbox

The agent builds a faithful copy of the affected software and fires the exploit, capturing the crash, the leak, or the shell.

Publish verifiable proof

A self-contained script, a session replay, and a permanent REPRO ID. Run pruva-verify to see it fire yourself.

Latest

Verified Reproductions

View all

REPRO-2026-00294 published

WordPress 7.0.1 pre-auth fresh-administrator chain to RCE

CVE-2026-63030 critical Security Variant found Known vulnerability

WordPress Core

65m 17s Jul 19, 2026

REPRO-2026-00293 published

Metabase arbitrary code execution via unsafe H2 connection property validation bypass

CVE-2026-59826 critical Security Variant found Known vulnerability github

metabase/metabase

92m 57s Jul 17, 2026

REPRO-2026-00292 published

websocket-driver: message corruption via abuse of draft-WebSocket length headers

CVE-2026-54466 critical Security Variant found Known vulnerability npm

faye/websocket-driver-node

7m 28s Jul 16, 2026

REPRO-2026-00291 published

The identifier

Why REPRO IDs?

Verified Proof

Each reproduction includes executable scripts, session replays, and before/after evidence proving the vulnerability exists.

Permanent Citation

REPRO IDs are permanent, citable references. Link CVEs, GHSAs, and issues to verified reproductions.

Full Transparency

Watch session replays showing exactly how the agent reproduced the issue. Nothing hidden, everything auditable.

Cite it

Embed in Your README

Show that your security advisory has been independently verified with an embeddable badge.

PRUVA REPRO-2026-00001

[![Reproduced by Pruva](https://api.pruva.dev/v1/reproductions/REPRO-2026-00001/badge.svg)](https://pruva.dev/reproductions/REPRO-2026-00001)

Don't take the advisory's word for it. Run it.

Browse the full catalog of autonomously reproduced vulnerabilities — each with a runnable proof and a permanent REPRO ID.

Browse All Reproductions →

A CVE tells you there's a vulnerability. Pruva shows you it firing.