ExploitArchive

A curated archive of public CVE exploits and proof-of-concept repositories.

Data flow

GitHub Archive events ──(Collection)──▶ pocs_archive/ ──(AI Review)──▶ review_pocs/ ──(Manual Curation)──▶ manual_curated_pocs/

Pipelines

The collection and review pipelines run as BasePipeline instances and require no command-line arguments.

Collection

The collect-pocs.yml workflow runs collect_pocs.py periodically. It:

• Fetches releases from Giant Hourly Archive repositories (configured years default to 2025-2026).
• Downloads compressed GitHub event files (*.json.gz) on demand.
• Dynamically discovers CVEs by scanning repository names and descriptions within the events (preventing false positives from commit messages or branch names).
• Tracks repository state across all event types:
  • Any event with data: adds or updates repository metadata (name, description)
• Saves matching repository metadata (URL, name, and description) under pocs_archive/<year>/<CVE-ID>.json.

The collector uses the GitHub Actions GITHUB_TOKEN to prevent API rate limiting and download throttling.

Review

The review-pocs.yml workflow runs agent.py periodically. It:

• Reads CVE records from pocs_archive/, skipping records already completed (checkpoint) or with existing output.
• For each repository matched to a CVE:
  • Verifies the repository exists via git ls-remote before cloning. Deleted, private, renamed, or typo'd URLs are recorded with status not_found — no clone is attempted and no AI tokens are spent on them.
  • Clones the repository (shallow, depth=1, bounded by a timeout) into a temporary directory.
  • Skips empty repositories and repositories exceeding MAX_REPO_FILES (statuses empty and too_large).
  • Extracts the file tree (up to 30 files, excluding .git/) and the README content (up to 8000 characters) if present.
• Sends repository data to an OpenAI-compatible LLM with a system prompt specialized for PoC analysis.
• The model returns a structured PoCReview containing:
  • is_valid_poc: whether the repository is a valid PoC for the CVE
  • confidence: confidence score (0-100)
  • need_manual_review: whether manual review is recommended
  • reasoning: a short, evidence-based justification used by human reviewers
• Applies a deterministic safety net: any verdict with confidence below MANUAL_REVIEW_THRESHOLD is flagged for manual review regardless of the model's own flag.
• Aggregates all reviews for a CVE under review_pocs/<year>/<CVE-ID>.json (the year is derived from the CVE ID, not the input folder). Each record contains:
  • has_valid_poc: at least one repository was confidently judged a valid PoC
  • needs_manual_review: the record is queued for human curation
  • per-repository entries with status, verdict, confidence, and reasoning
• Commits review_pocs/ and the checkpoint back to the repository, and writes a run summary listing the records flagged for manual review.
• Optionally copies valid PoCs to manual_curated_pocs/<year>/<CVE-ID>.json if the curate_valid flag is enabled (off by default — manual curation owns that directory).