Autonomous reproduction · GHSA/CVE → runnable proof

A CVE tells you there's a vulnerability.
Pruva shows you it firing.

Every published GHSA and CVE, autonomously reproduced in a sandbox — each with a runnable script, a session replay, and a permanent REPRO-YYYY-NNNNN identifier. Run pruva-verify and see it for yourself.

Browse Reproductions View Stats

pruva · REPRO-2026-00186 · libssh2 via curl PROVEN

$ pruva-verify REPRO-2026-00186

fetching reproduction script… isolated sandbox ready

building curl against libssh2 1.11.0 · spawning AsyncSSH peer

running reproduction_steps.sh

Segmentation fault — libssh2 packet length parser

exit 139 · libssh2 packet parser crash · reproduces 3/3

VERIFIED — reproduced in a clean sandbox.

281 Reproductions

41 Ecosystems

48m 48s Avg. Duration

$4.34 Median Spend (252/281)

100% Autonomous

How it works

Advisory to runnable proof, autonomously.

Analyze the advisory

An AI agent reads the GHSA or CVE, pulls the vulnerable package, and understands the vulnerability's root cause.

Reproduce in a sandbox

The agent builds a faithful copy of the affected software and fires the exploit, capturing the crash, the leak, or the shell.

Publish verifiable proof

A self-contained script, a session replay, and a permanent REPRO ID. Run pruva-verify to see it fire yourself.

Latest

Verified Reproductions

View all

REPRO-2026-00385 published

HashiCorp Nomad's Docker task driver can be tricked into bind-mounting host paths via a symlink containment bypass, enabling sandbox escape and host file read/write.

CVE-2026-14891 high Security Known vulnerability other

hashicorp/nomad

110m 14s Oct 9, 2026

REPRO-2026-00384 published

CodeIgniter4 View Parser conditional tags allow arbitrary PHP code execution in user-editable templates

GHSA-4Q58-JW8X-8CM7 high Security Known vulnerability composer

codeigniter4/framework (Composer ecosystem)

77m 41s Oct 9, 2026

REPRO-2026-00383 published

vm2 before 3.12.1 sandbox escape via host-realm Promise Symbol.species (VM and NodeVM)

CVE-2026-93606 critical Security Known vulnerability github

patriksimek/vm2

45m 4s Oct 9, 2026

REPRO-2026-00382 published

gVisor directfs openHandle host-FD identity TOCTOU → guest-to-host sandbox escape (follow-up to CVE-2026-96812, no separate CVE assigned)

CVE-2026-96812 high Security Known vulnerability github

google/gvisor

191m 18s Oct 9, 2026

REPRO-2026-00381 published

IBM Langflow OSS 1.0.0 through 1.12.2 is vulnerable to remote unauthenticated code execution via OS command injection.

CVE-2026-93674 critical Security Known vulnerability PyPI / Python

langflow-ai/langflow

74m 34s Oct 9, 2026

REPRO-2026-00380 published

Ghost CMS RCE via Bookmark Card Images (SVG handling in bundled image processing library)

CVE-2026-105642 high Security Known vulnerability github

TryGhost/Ghost

161m 52s Oct 6, 2026

The identifier

Why REPRO IDs?

Verified Proof

Each reproduction includes executable scripts, session replays, and before/after evidence proving the vulnerability exists.

Permanent Citation

REPRO IDs are permanent, citable references. Link CVEs, GHSAs, and issues to verified reproductions.

Full Transparency

Watch session replays showing exactly how the agent reproduced the issue. Nothing hidden, everything auditable.

Cite it

Embed in Your README

Show that your security advisory has been independently verified with an embeddable badge.

PRUVA REPRO-2026-00001

[![Reproduced by Pruva](https://api.pruva.dev/v1/reproductions/REPRO-2026-00001/badge.svg)](https://www.pruva.dev/reproductions/REPRO-2026-00001)

Don't take the advisory's word for it. Run it.

Browse the full catalog of autonomously reproduced vulnerabilities — each with a runnable proof and a permanent REPRO ID.

Browse All Reproductions →

A CVE tells you there's a vulnerability. Pruva shows you it firing.