From 31ad73b5319ebd5544c35736a752f511a1e03918 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 23:00:28 +0200 Subject: [PATCH] chore: Update torch to 2.8.0 (CVE-2025-3730 fix) - Upgrade torch from >=2.6.0 to >=2.8.0 - Fixes CVE-2025-3730: DoS in torch.nn.functional.ctc_loss - Vulnerability in LossCTC.cpp leads to denial of service - Local attack with low complexity, requires low privileges - Also fixes CVE-2025-32434 (torch.load RCE) Fixes Dependabot Alert #34 --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index f5273094..9ee69be1 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -24,7 +24,7 @@ pydantic>=2.4.0 # Security fix: CVE-2024-3772 (ReDoS via crafted email) # Models # Security: transformers >=4.51.0 fixes CVE-2025-3263 (ReDoS in get_configuration_file) # Current spec (>=4.53.0) is already safe. Dependabot alert is false positive due to missing lockfile. -torch>=2.6.0 # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True) +torch>=2.8.0 # Security fix: CVE-2025-32434 (torch.load RCE), CVE-2025-3730 (DoS in ctc_loss) transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051 (ReDoS) huggingface_hub>=0.20.0