gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 23:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Update Flask to fix CVE-2026-27205

Browse Source 
- Update flask from >=3.1.0 to >=3.1.3
- Fixes GHSA-68rp-wp8r-4726
- Vary: Cookie header not set when session accessed via 'in' operator
This commit is contained in:
TPTBusiness
2026-04-02 23:01:10 +02:00
parent 5cae7247f0
commit a2d977ff78
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
+2 -1
View File
@@ -28,11 +28,12 @@ spacy==3.7.2
# Security: Upgrade Werkzeug/Flask AFTER webshop to override transitive dependencies
# webshop 0.1.0 depends on Werkzeug 2.2.3, but we force upgrade to 3.1.6+
# Security Notes:
# - CVE-2026-27205: Vary: Cookie header not set in some cases (fixed in 3.1.3)
# - CVE-2026-27199: Windows device names in safe_join() (fixed in 3.1.6)
# - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4)
# - CVE-2024-49766: safe_join UNC path bypass on Windows (fixed in 3.0.6)
# - CVE-2024-34069: Werkzeug debugger RCE (fixed in 3.0.3+)
# - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed)
# - CVE-2023-46136: DoS via multipart/form-data parser (fixed in 2.3.8+)
flask>=3.1.0 # Override webshop's Flask 2.2.5 dependency
flask>=3.1.3 # Override webshop's Flask 2.2.5 dependency - fixes CVE-2026-27205
Werkzeug>=3.1.6 # Override webshop's Werkzeug 2.2.3 dependency - fixes all CVEs