From 2220257e12d2611f55d310faf0c180a26bbe8aad Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:57:09 +0200 Subject: [PATCH] chore: Add CVE-2023-46136 to Werkzeug security notes - Document CVE-2023-46136 (DoS via multipart/form-data parser) - Already fixed by Werkzeug>=3.1.6 upgrade - Fixes Dependabot Alert #1 --- .../rl/autorl_bench/benchmarks/webshop/requirements.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt index 3d442209..92c5bd7e 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt @@ -30,5 +30,6 @@ spacy==3.7.2 # - CVE-2024-49766: safe_join UNC path bypass on Windows (fixed in 3.0.6) # - CVE-2024-34069: Werkzeug debugger RCE (fixed) # - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed) +# - CVE-2023-46136: DoS via multipart/form-data parser (fixed in 2.3.8) flask>=3.0.0 Werkzeug>=3.1.6 # Security fix: All Werkzeug CVEs fixed (Windows + Linux) \ No newline at end of file