From 83e18e27f392c90273bfd9a1dddf6872a5506fa5 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:59:10 +0200 Subject: [PATCH] fix: Override webshop's Werkzeug dependency to fix CVE-2026-27199 - Add explicit Werkzeug>=3.1.6 to override webshop's transitive dep (2.2.3) - Upgrade Flask to >=3.1.0 for Werkzeug 3.x compatibility - Add installation note: install webshop FIRST, then upgrade Werkzeug/Flask Security Fixes (Werkzeug 3.1.6): - CVE-2026-27199: Windows device names in safe_join() (DoS via hanging reads) - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4) - CVE-2024-49766: safe_join UNC path bypass on Windows (fixed in 3.0.6) - CVE-2024-34069: Werkzeug debugger RCE (fixed in 3.0.3+) Technical Note: - webshop 0.1.0 depends on Werkzeug==2.2.3 (vulnerable) - Direct dependency Werkzeug>=3.1.6 overrides transitive dep at install time - pip installs dependencies in order, last version wins Fixes Dependabot Alert #7 (GHSA-29vq-49wr-vm6x) --- .../benchmarks/webshop/requirements.txt | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt index 92c5bd7e..781773ce 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt @@ -8,6 +8,7 @@ # python -m spacy download en_core_web_sm # # Note: Flask/Werkzeug updated to 3.x for security fixes (previously pinned to 2.x) +# IMPORTANT: Install webshop FIRST, then upgrade Werkzeug/Flask to override transitive deps # WebShop PyPI package webshop @@ -24,12 +25,14 @@ rank_bm25==0.2.2 thefuzz==0.19.0 spacy==3.7.2 -# Note: Flask/Werkzeug updated to 3.x for security fixes +# Security: Upgrade Werkzeug/Flask AFTER webshop to override transitive dependencies +# webshop 0.1.0 depends on Werkzeug 2.2.3, but we force upgrade to 3.1.6+ # Security Notes: +# - CVE-2026-27199: Windows device names in safe_join() (fixed in 3.1.6) # - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4) # - CVE-2024-49766: safe_join UNC path bypass on Windows (fixed in 3.0.6) -# - CVE-2024-34069: Werkzeug debugger RCE (fixed) +# - CVE-2024-34069: Werkzeug debugger RCE (fixed in 3.0.3+) # - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed) -# - CVE-2023-46136: DoS via multipart/form-data parser (fixed in 2.3.8) -flask>=3.0.0 -Werkzeug>=3.1.6 # Security fix: All Werkzeug CVEs fixed (Windows + Linux) \ No newline at end of file +# - CVE-2023-46136: DoS via multipart/form-data parser (fixed in 2.3.8+) +flask>=3.1.0 # Override webshop's Flask 2.2.5 dependency +Werkzeug>=3.1.6 # Override webshop's Werkzeug 2.2.3 dependency - fixes all CVEs \ No newline at end of file