From a935786e2beffd7c043b6970f774fc26b73f19ae Mon Sep 17 00:00:00 2001
From: TPTBusiness <tpt.requests@pm.me>
Date: Thu, 2 Apr 2026 22:54:58 +0200
Subject: [PATCH] chore: Document vLLM CVE-2026-22807 is already fixed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add comment explaining vLLM >=0.18.0 is already safe (CVE fixed in >=0.14.0)
- Dependabot alert #44 is false positive due to missing lockfile
- Translate all comments to English (project language policy)
- No version change needed - current specification is already secure

Security Status:
- CVE-2026-22807: Fixed in vLLM >=0.14.0, current spec >=0.18.0 ✓
- CVE-2026-22778: Fixed in current version ✓
- CVE-2026-27893: Fixed in current version ✓

Note: Without a lockfile (pip-tools/uv/poetry), Dependabot cannot determine
the installed version and raises alerts based on the requirement spec alone.
---
 .../rl/autorl_bench/requirements.txt          | 24 ++++++++++---------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/rdagent/scenarios/rl/autorl_bench/requirements.txt b/rdagent/scenarios/rl/autorl_bench/requirements.txt
index 3bb74c3a..ba50ca86 100644
--- a/rdagent/scenarios/rl/autorl_bench/requirements.txt
+++ b/rdagent/scenarios/rl/autorl_bench/requirements.txt
@@ -1,34 +1,36 @@
-# AutoRL-Bench 依赖
-# conda 环境: (Python 3.10)
+# AutoRL-Bench Dependencies
+# conda environment: Python 3.10
 
-# RL 训练（核心）
+# RL Training (core)
 trl>=0.27.0
 accelerate>=1.0.0
 datasets>=3.0.0
 peft>=0.18.1
 
-# 评测
+# Evaluation
 opencompass==0.5.1
-setuptools<75  # uv venv 不自带, opencompass 依赖 pkg_resources
+setuptools<75  # uv venv doesn't include, opencompass depends on pkg_resources
 
-# 推理加速（可选，TRL 支持 0.10.2-0.12.0）
-vllm>=0.18.0  # Security fix: CVE-2026-22778 (JPEG2000 RCE), CVE-2026-22807 (auto_map RCE), CVE-2026-27893 (trust_remote_code)
+# Inference acceleration (optional, TRL supports 0.10.2-0.12.0)
+# Security: Version >=0.14.0 fixes CVE-2026-22807 (RCE via auto_map dynamic module loading)
+# Current spec (>=0.18.0) is already safe. Dependabot alert is false positive due to missing lockfile.
+vllm>=0.18.0  # Security fix: CVE-2026-22778 (RCE via JPEG2000 heap overflow) + CVE-2026-27893
 
-# 数据处理
+# Data processing
 numpy>=1.26.0
 pandas>=1.5.0
 pydantic>=2.0.0
 
-# 模型
+# Models
 torch>=2.6.0  # Security fix: CVE-2025-32434 (torch.load RCE with weights_only=True)
 transformers>=4.48.0  # Security fix: CVE-2024-11393 (Deserialization RCE)
 huggingface_hub>=0.20.0
 
-# Web 服务
+# Web services
 flask
 flask-cors
 
-# 工具
+# Tools
 loguru
 requests
 pyyaml