标题： 从CVE条目到可验证的利用：一种自动化的多智能体框架，用于重现CVE 显示英文标题

标题： From CVE Entries to Verifiable Exploits: An Automated Multi-Agent Framework for Reproducing CVEs

摘要： 高质量的真实漏洞数据集及其对应的可验证利用方式是软件安全研究中的关键资源。 然而，这类资源仍然稀缺，因为其创建需要大量的手动工作和深入的安全专业知识。 在本文中，我们提出了CVE-GENIE，一个基于大型语言模型（LLM）的自动化多智能体框架，旨在以通用漏洞和暴露（CVE）格式重现真实世界漏洞，以实现高质量漏洞数据集的创建。 给定一个CVE条目作为输入，CVE-GENIE收集该CVE的相关资源，自动重建易受攻击的环境，并（重新）生成可验证的利用方式。 我们的系统评估突显了CVE-GENIE设计的效率和鲁棒性，并成功重现了大约51%（428/841）2024-2025年发布的CVE，每个CVE的平均成本为2.77美元，且完整地包含其可验证的利用方式。 我们的流程提供了一种强大的方法来生成可重复的CVE基准，对于多种应用（如模糊测试评估、漏洞修补和评估AI的安全能力）具有价值。 显示英文摘要

摘要： High-quality datasets of real-world vulnerabilities and their corresponding verifiable exploits are crucial resources in software security research. Yet such resources remain scarce, as their creation demands intensive manual effort and deep security expertise. In this paper, we present CVE-GENIE, an automated, large language model (LLM)-based multi-agent framework designed to reproduce real-world vulnerabilities, provided in Common Vulnerabilities and Exposures (CVE) format, to enable creation of high-quality vulnerability datasets. Given a CVE entry as input, CVE-GENIE gathers the relevant resources of the CVE, automatically reconstructs the vulnerable environment, and (re)produces a verifiable exploit. Our systematic evaluation highlights the efficiency and robustness of CVE-GENIE's design and successfully reproduces approximately 51% (428 of 841) CVEs published in 2024-2025, complete with their verifiable exploits, at an average cost of $2.77 per CVE. Our pipeline offers a robust method to generate reproducible CVE benchmarks, valuable for diverse applications such as fuzzer evaluation, vulnerability patching, and assessing AI's security capabilities.