From 5881a3f776b72dd630d27b35facf33f2ac3e0f4a Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:54:29 +0200 Subject: [PATCH] chore: Add CVE-2026-22807 to vllm security fix comment - Update vllm comment to include auto_map RCE vulnerability - Version >=0.18.0 fixes all three vllm CVEs: - CVE-2026-22778 (JPEG2000 heap overflow RCE) - CVE-2026-22807 (auto_map dynamic module RCE) - CVE-2026-27893 (trust_remote_code override) --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index c2bd1067..3bb74c3a 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -12,7 +12,7 @@ opencompass==0.5.1 setuptools<75 # uv venv 不自带, opencompass 依赖 pkg_resources # 推理加速（可选，TRL 支持 0.10.2-0.12.0） -vllm>=0.18.0 # Security fix: CVE-2026-22778 (RCE via JPEG2000 heap overflow) + CVE-2026-27893 +vllm>=0.18.0 # Security fix: CVE-2026-22778 (JPEG2000 RCE), CVE-2026-22807 (auto_map RCE), CVE-2026-27893 (trust_remote_code) # 数据处理 numpy>=1.26.0