一句话：提出基于版本差异与 LLM 迭代反馈的 exploit 迁移方法，自动适配库漏洞利用程序到其它版本。
论文关注开源库漏洞利用程序（exploit）在跨版本复用时的失败问题：库演化引入的破坏性变更会改变触发条件（如 API 重构），或破坏动态环境（如构建、运行时错误），人工解读与适配代价高。现有工作主要依赖模糊测试做代码级执行轨迹对齐，既耗时又难以处理环境层失败与复杂的触发条件变化。作者提出 Diffploit，一种迭代式、以 diff 驱动的 exploit 迁移方法，由 Context 模块与 Migration 模块构成：前者通过分析目标版本与参考版本之间的行为差异，构造刻画失败症状及其相关 diff hunk 的上下文；后者基于该上下文引导 LLM 进行自适应修改，并通过迭代反馈循环在探索候选 diff 与逐步精化之间取得平衡，直至复现失败被解决。在 79 个库、102 个 Java CVE、689 个版本迁移任务的数据集上，Diffploit 成功迁移 84.2% 的 exploit，分别比变更感知测试修复工具 TaRGET 与 IDEA 中的规则化工具高出 52.0% 与 61.6%；此外还发现 5 个受影响版本范围标注错误的 CVE 报告（3 个已被确认），以及 111 个 GitHub Advisory Database 中未报告的受影响版本。
Exploits are commonly used to demonstrate the presence of library vulnerabilities and validate their impact across different versions. However, their direct application to alternative versions often fails due to breaking changes introduced during evolution. These failures stem from both changes in triggering conditions (e.g., API refactorings) and broken dynamic environments (e.g., build or runtime errors), which are challenging to interpret and adapt manually. Existing techniques primarily focus on code-level trace alignment through fuzzing, which is both time-consuming and insufficient for handling environment-level failures. Moreover, they often fall short when dealing with complicated triggering condition changes across versions. To overcome this, we propose Diffploit, an iterative, diff-driven exploit migration method structured around two key modules: the Context Module and the Migration Module. The Context Module constructs contexts derived from analyzing behavioral discrepancies between the target and reference versions, which capture the failure symptom and its related diff hunks. Leveraging these contexts, the Migration Module guides an LLM-based adaptation through an iterative feedback loop, balancing exploration of diff candidates and gradual refinement to resolve reproduction failures effectively. We evaluate Diffploit on a large-scale dataset containing 102 Java CVEs and 689 version-migration tasks across 79 libraries. Diffploit successfully migrates 84.2% exploits, outperforming the change-aware test repair tool TaRGET by 52.0% and the rule-based tool in IDEA by 61.6%. Beyond technical effectiveness, Diffploit identifies 5 CVE reports with incorrect affected version ranges, three of which have been confirmed. We also discover 111 unreported versions in GitHub Advisory Database.
@inproceedings{abs-2511-12950,
title = {Diffploit: Facilitating Cross-Version Exploit Migration for Open Source Library Vulnerabilities},
author = {Zirui Chen and Zhipeng Xue and Jiayuan Zhou and Xing Hu and Xin Xia and Xiaohu Yang},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773205}
}