From 79df01f82aa05872d916a7f412713f5eedc8f992 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 23:03:18 +0200 Subject: [PATCH] chore: Add CVE-2025-6638 to transformers security notes - Document CVE-2025-6638 (ReDoS in MarianTokenizer.remove_language_code) - Already fixed by transformers>=4.53.0 (patched in 4.53.0) - Dependabot alert is false positive due to missing lockfile Fixes Dependabot Alert #41 --- rdagent/scenarios/rl/autorl_bench/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt index 35b7154d..542ba2ff 100644 --- a/rdagent/scenarios/rl/autorl_bench/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt @@ -27,7 +27,7 @@ pydantic>=2.4.0 # Security fix: CVE-2024-3772 (ReDoS via crafted email) # Security: transformers >=4.52.1 fixes CVE-2025-3777 (URL validation bypass via username injection) # Current spec (>=4.53.0) is already safe. Dependabot alerts are false positives due to missing lockfile. torch>=2.8.0 # Security fix: CVE-2025-32434 (torch.load RCE), CVE-2025-3730 (DoS in ctc_loss) -transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051/1194 (ReDoS), CVE-2025-3777 (URL validation) +transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051/1194/6638 (ReDoS), CVE-2025-3777 (URL validation) huggingface_hub>=0.20.0 # Web services