One Pipeline Does Not Fit All: TAILOR, a Type- and State-Aware Framework for CVE Reproduction
TAILOR, a type- and state-aware multi-agent framework, automatically reproduces complex CVEs and packages auditable trigger evidence.
TAILOR is a multi-agent framework for end-to-end CVE reproduction that adapts execution to vulnerability type and required state. A type-aware stage selects an execution path, and a Web-specific stage builds prerequisite state before triggering the bug, then packages environments and triggers as auditable artifacts. On a 200-CVE dataset emphasizing complex cases, it reproduced 59.24% of Web vulnerabilities and 44.19% of traditional vulnerabilities. Ablations indicate the two control levels reduce path mismatch and missing Web prerequisite state.
- TAILOR is a multi-agent system that builds auditable CVE reproduction artifacts.
- Type-aware routing selects an execution path; Web cases also construct prerequisite state.
- On 200 complex CVEs it reproduced 59.24% of Web and 44.19% of traditional bugs.
From the original article
1 min read at arxiv.orgGrowing vulnerability disclosure and widespread software reuse increase security teams' need for reproducible evidence to diagnose vulnerabilities, validate patches, and build regression tests. Producing such evidence at scale requires automated end-to-end CVE reproduction.
By Ji He · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.