From fe8ee4e8ddc9021e2a699b3a1523cc4ef678d2ec Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:56:15 +0200 Subject: [PATCH] chore: Fix Werkzeug CVEs with upgrade to 3.1.6 - Upgrade Werkzeug from 2.3.8 to 3.1.6 (fixes all Werkzeug CVEs) - Upgrade Flask from 2.2.5 to 3.0.0+ (required for Werkzeug 3.x) - Add CVE-2024-49766 (safe_join UNC path bypass) to security notes - Update comments to reflect Flask 3.x compatibility Fixed CVEs: - CVE-2025-66221: Windows device names in safe_join() - CVE-2024-49766: safe_join UNC path bypass on Windows - CVE-2024-34069: Werkzeug debugger RCE - CVE-2024-49767: Resource exhaustion via multipart/form-data Fixes Dependabot Alerts #2, #3, #4 --- .../rl/autorl_bench/benchmarks/webshop/requirements.txt | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt index 7e3e4829..3d442209 100644 --- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt +++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt @@ -7,7 +7,7 @@ # pip install -r benchmarks/webshop/requirements.txt # python -m spacy download en_core_web_sm # -# Note: Flask/Werkzeug pinned to 2.x (Flask 3.x incompatible with WebShop) +# Note: Flask/Werkzeug updated to 3.x for security fixes (previously pinned to 2.x) # WebShop PyPI package webshop @@ -27,7 +27,8 @@ spacy==3.7.2 # Note: Flask/Werkzeug updated to 3.x for security fixes # Security Notes: # - CVE-2025-66221: Windows device names in safe_join() (fixed in 3.1.4) +# - CVE-2024-49766: safe_join UNC path bypass on Windows (fixed in 3.0.6) # - CVE-2024-34069: Werkzeug debugger RCE (fixed) # - CVE-2024-49767: Resource exhaustion via multipart/form-data (fixed) flask>=3.0.0 -Werkzeug>=3.1.6 # Security fix: CVE-2025-66221 (Windows device names) \ No newline at end of file +Werkzeug>=3.1.6 # Security fix: All Werkzeug CVEs fixed (Windows + Linux) \ No newline at end of file