diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
index 404e8247..136c97bb 100644
--- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
+++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
@@ -1,21 +1,21 @@
-# WebShop benchmark 依赖
+# WebShop Benchmark Dependencies
 #
-# 前置要求：Java 11+ (JDK) 和 faiss-cpu
+# Prerequisites: Java 11+ (JDK) and faiss-cpu
 #   conda install -c conda-forge openjdk=11 faiss-cpu
 #
-# 安装命令:
+# Installation:
 #   pip install -r benchmarks/webshop/requirements.txt
 #   python -m spacy download en_core_web_sm
 #
-# 注意：Flask/Werkzeug 已在主 requirements.txt 中固定为 2.x 版本
+# Note: Flask/Werkzeug pinned to 2.x (Flask 3.x incompatible with WebShop)
 
-# WebShop PyPI 包
+# WebShop PyPI package
 webshop
 
-# 数据下载工具
+# Data download tool
 gdown
 
-# WebShop 特有依赖
+# WebShop specific dependencies
 gym==0.24.0
 beautifulsoup4==4.11.1
 cleantext==1.1.4
@@ -24,6 +24,8 @@ rank_bm25==0.2.2
 thefuzz==0.19.0
 spacy==3.7.2
 
-# 注意：Flask/Werkzeug 固定为 2.x（Flask 3.x 与 WebShop 不兼容）
+# Note: Flask/Werkzeug pinned to 2.x (Flask 3.x incompatible with WebShop)
+# Security Note: CVE-2024-34069 affects Werkzeug debugger (dev mode only)
+# Mitigation: Never run with debug=True in production; benchmark runs locally
 flask==2.2.5
-Werkzeug==2.2.3
\ No newline at end of file
+Werkzeug==2.3.8  # Latest 2.x with security patches
\ No newline at end of file