Tailor framework improves automated vulnerability reproduction accuracy
One Pipeline Does Not Fit All: TAILOR, a Type- and State-Aware Framework for CVE Reproduction
Cryptography and Security
Summary
Finding and fixing software security problems often requires repeating the steps that cause the issue, which can be tricky to automate because different problems need different ways to be triggered. The authors created TAILOR, a system that understands the type and state of each security vulnerability and adapts its process accordingly to reproduce the problem more effectively. TAILOR separates setting up the right environment from actually causing the problem, making it easier to generate reliable evidence for fixing software bugs. Their tests with 200 vulnerabilities showed TAILOR handles complex cases better than one-size-fits-all methods.
What this means in practice
- •For security operations teams: Automatically reproduce complex vulnerabilities to generate evidence for diagnosing security issues and validating patches.
- •For penetration testers: Generate auditable exploit evidence tailored to different vulnerability types and states to improve testing accuracy.
Authors
Ji He, Huang Zhang, Lijie Zheng, Lele Zheng, Yulong Shen
Abstract
Growing vulnerability disclosure and widespread software reuse increase security teams' need for reproducible evidence to diagnose vulnerabilities, validate patches, and build regression tests. Producing such evidence at scale requires automated end-to-end CVE reproduction. Existing methods typically process different CVEs through a uniform pipeline, but differences in runtime form, trigger interfaces, and prerequisite state impose different execution requirements on individual stages, making fixed workflows difficult to adapt to diverse reproduction needs. To address this problem, we present TAILOR, a type- and state-aware multi-agent framework specialized for complex vulnerability reproduction. TAILOR converts static vulnerability information into auditable reproduction evidence and packages reconstructed environments and trigger evidence into reproduction artifacts. Its first-level type-aware mechanism adaptively matches each vulnerability to an execution path. Within the Web path, its second-level state-aware mechanism constructs the required prerequisite state before exploitation, decouples prerequisite-state construction from core vulnerability triggering, and shares execution constraints across exploitation and verification. We construct a dataset of 200 CVEs with an emphasis on cases with complex execution requirements. TAILOR successfully reproduces 59.24\% of Web vulnerabilities and 44.19\% of traditional vulnerabilities. Further ablation experiments show that the two control levels respectively mitigate execution-path mismatch and missing Web prerequisite state. Overall, TAILOR broadens the coverage of automated CVE reproduction and provides auditable evidence for vulnerability diagnosis and defense.