Abstract:High-quality vulnerable code datasets are essential for advancing software security research. Such datasets constitute core resources for vulnerability analysis, vulnerability detection model training and evaluation, system comparison, and attack-defense research. Unlike datasets in domains such as computer vision, existing vulnerability datasets are limited in scale and often suffer from inconsistent quality and insufficient diversity. To address these limitations, this study proposes CodeVulnGen, an automated code vulnerability data generation framework based on large language models (LLMs) and centered on vulnerability characteristics. The framework systematically defines the quality attributes of vulnerable code and the corresponding evaluation methods. Based on this, a three-stage prompt construction strategy is proposed that progressively integrates structured descriptions, few-shot examples, real-world vulnerability characteristics, and chain-of-thought reasoning to generate diverse, well-structured, and highly complex vulnerable code that more closely resembles real-world attack scenarios. Experimental results show that fine-tuning the Qwen-4B model on the generated dataset improves the F1 score by 7.4% and yields a 5.5% performance improvement compared with training on real-world datasets.