From 197b5ab51bb47be3d0c385936f8a3a6f67b1afc7 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:55:56 +0200 Subject: [PATCH] chore: Update Werkzeug to fix CVE-2025-66221 - Update Werkzeug from ==2.3.8 to >=3.1.6 - Update Flask from ==2.2.5 to >=3.0.0 - Fixes GHSA-hgf8-39gv-g3f2 (Windows device names in safe_join) - Also fixes CVE-2024-34069 and CVE-2024-49767 --- .../autorl_bench/benchmarks/webshop/requirements.txt | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt index 1acee7d1..7e3e4829 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt @@ -24,10 +24,10 @@ rank_bm25==0.2.2 thefuzz==0.19.0 spacy==3.7.2 -# Note: Flask/Werkzeug pinned to 2.x (Flask 3.x incompatible with WebShop) +# Note: Flask/Werkzeug updated to 3.x for security fixes # Security Notes: -# - CVE-2024-34069: Werkzeug debugger RCE (dev mode only) -# - CVE-2024-49767: Resource exhaustion via multipart/form-data -# Mitigation: Benchmark runs locally with max_content_length limits; never use debug=True in production -flask==2.2.5 -Werkzeug==2.3.8 # Latest 2.x with security patches (CVE-2024-34069, CVE-2024-49767 mitigated) \ No newline at end of file +# - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4) +# - CVE-2024-34069: Werkzeug debugger RCE (fixed) +# - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed) +flask>=3.0.0 +Werkzeug>=3.1.6 # Security fix: CVE-2025-66221 (Windows device names) \ No newline at end of file