LVRP - Local Vuln Research Pipeline
A local, whitebox vulnerability-research pipeline that builds a call graph across a codebase, enumerates every path from untrusted input to a dangerous operation, and uses a code-specialized LLM to judge which paths are exploitable.
LVRP parses source files across sixteen languages, builds a complete call graph including cross-file imports, tags every untrusted input source and dangerous operation sink, and exhaustively enumerates every path between them rather than sampling. It tracks taint through each function on a path, both within and across procedures, and cross-references known sanitizers against sink categories through a normalized taxonomy.
Clear-cut cases, such as a matched sanitizer, are classified deterministically; ambiguous paths go to a local LLM for exploitability review, with relevant product CVEs injected into its prompts for pattern matching. Files not covered by any traced path get a separate blind-spot review, and the pipeline can synthesize multi-step exploit chains and analyze memory corruption in C, C++ and Rust code.
It has been run against codebases ranging from small scripts up to the Linux kernel, VS Code, the Microsoft Agent Framework and GitHub Desktop, and is written in Python.