Autonomous reproduction · GHSA/CVE → runnable proof

A CVE tells you there's a vulnerability.
Pruva shows you it firing.

Every published GHSA and CVE, autonomously reproduced in a sandbox — each with a runnable script, a session replay, and a permanent REPRO-YYYY-NNNNN identifier. Run pruva-verify and see it for yourself.

Browse Reproductions View Stats

pruva · REPRO-2026-00186 · libssh2 via curl PROVEN

$ pruva-verify REPRO-2026-00186

fetching reproduction script… isolated sandbox ready

building curl against libssh2 1.11.0 · spawning AsyncSSH peer

running reproduction_steps.sh

Segmentation fault — libssh2 packet length parser

exit 139 · libssh2 packet parser crash · reproduces 3/3

VERIFIED — reproduced in a clean sandbox.

189 Reproductions

32 Ecosystems

33m 10s Avg. Duration

$2.80 Median Spend (160/189)

100% Autonomous

How it works

Advisory to runnable proof, autonomously.

Analyze the advisory

An AI agent reads the GHSA or CVE, pulls the vulnerable package, and understands the vulnerability's root cause.

Reproduce in a sandbox

The agent builds a faithful copy of the affected software and fires the exploit, capturing the crash, the leak, or the shell.

Publish verifiable proof

A self-contained script, a session replay, and a permanent REPRO ID. Run pruva-verify to see it fire yourself.

Latest

Verified Reproductions

View all

REPRO-2026-00286 published

Log4j MapMessage emits invalid JSON for non-finite values

CVE-2026-49844 medium Security Variant found maven

org.apache.logging.log4j:log4j-api

11m 14s Jul 13, 2026

REPRO-2026-00285 published

Samba’s printing subsystem allows OS command injection via unescaped job description (%J), enabling remote code execution through crafted print jobs.

CVE-2026-4480 high Security Variant found generic

samba-team/samba

28m 55s Jul 13, 2026

REPRO-2026-00284 published

The identifier

Why REPRO IDs?

Verified Proof

Each reproduction includes executable scripts, session replays, and before/after evidence proving the vulnerability exists.

Permanent Citation

REPRO IDs are permanent, citable references. Link CVEs, GHSAs, and issues to verified reproductions.

Full Transparency

Watch session replays showing exactly how the agent reproduced the issue. Nothing hidden, everything auditable.

Cite it

Embed in Your README

Show that your security advisory has been independently verified with an embeddable badge.

PRUVA REPRO-2026-00001

[![Reproduced by Pruva](https://api.pruva.dev/v1/reproductions/REPRO-2026-00001/badge.svg)](https://pruva.dev/r/REPRO-2026-00001)

Don't take the advisory's word for it. Run it.

Browse the full catalog of autonomously reproduced vulnerabilities — each with a runnable proof and a permanent REPRO ID.

Browse All Reproductions →

A CVE tells you there's a vulnerability. Pruva shows you it firing.