diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt
index bff0fe34..c2bd1067 100644
--- a/rdagent/scenarios/rl/autorl_bench/requirements.txt
+++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt
@@ -12,7 +12,7 @@ opencompass==0.5.1
 setuptools<75  # uv venv 不自带, opencompass 依赖 pkg_resources
 
 # 推理加速（可选，TRL 支持 0.10.2-0.12.0）
-vllm>=0.18.0  # Security fix: CVE-2026-27893 (Hardcoded trust_remote_code RCE)
+vllm>=0.18.0  # Security fix: CVE-2026-22778 (RCE via JPEG2000 heap overflow) + CVE-2026-27893
 
 # 数据处理
 numpy>=1.26.0