From 5bbe631eb59d72c0d28e53a99c3f7bf3a2f8f52e Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:59:56 +0200 Subject: [PATCH] chore: Update transformers to 4.53.0 (CVE-2025-6051 fix) - Upgrade transformers from >=4.52.1 to >=4.53.0 - Fixes CVE-2025-6051: ReDoS in EnglishNormalizer.normalize_numbers() - Crafted numeric strings can cause excessive CPU consumption - Affects text-to-speech and number normalization tasks Fixes Dependabot Alert #42 --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index fe6ab077..a1d2a8c0 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -23,7 +23,7 @@ pydantic>=2.4.0 # Security fix: CVE-2024-3772 (ReDoS via crafted email) # Models torch>=2.6.0 # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True) -transformers>=4.52.1 # Security: CVE-2024-11393 (RCE) + CVE-2025-3264/3933/2099 (ReDoS) +transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051 (ReDoS) huggingface_hub>=0.20.0 # Web services