From a2d977ff783fa3545a17c0078b68e265db034d18 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 23:01:10 +0200 Subject: [PATCH] chore: Update Flask to fix CVE-2026-27205 - Update flask from >=3.1.0 to >=3.1.3 - Fixes GHSA-68rp-wp8r-4726 - Vary: Cookie header not set when session accessed via 'in' operator --- .../rl/autorl_bench/benchmarks/webshop/requirements.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt index 781773ce..7ec6e794 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt @@ -28,11 +28,12 @@ spacy==3.7.2 # Security: Upgrade Werkzeug/Flask AFTER webshop to override transitive dependencies # webshop 0.1.0 depends on Werkzeug 2.2.3, but we force upgrade to 3.1.6+ # Security Notes: +# - CVE-2026-27205: Vary: Cookie header not set in some cases (fixed in 3.1.3) # - CVE-2026-27199: Windows device names in safe_join() (fixed in 3.1.6) # - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4) # - CVE-2024-49766: safe_join UNC path bypass on Windows (fixed in 3.0.6) # - CVE-2024-34069: Werkzeug debugger RCE (fixed in 3.0.3+) # - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed) # - CVE-2023-46136: DoS via multipart/form-data parser (fixed in 2.3.8+) -flask>=3.1.0 # Override webshop's Flask 2.2.5 dependency +flask>=3.1.3 # Override webshop's Flask 2.2.5 dependency - fixes CVE-2026-27205 Werkzeug>=3.1.6 # Override webshop's Werkzeug 2.2.3 dependency - fixes all CVEs \ No newline at end of file