TPTBusiness 3cfa3dda6f fix(security): Upgrade vllm and transformers to patch 4 CVEs ...

- Upgrade vllm >=0.18.0 → >=0.19.0
  - CVE-2026-34753: SSRF in download_bytes_from_url (CVSS 5.3)
  - CVE-2026-34756: OOM DoS via unbounded 'n' parameter (CVSS 6.5)
  - CVE-2026-34755: OOM DoS via unbounded video/jpeg frames (CVSS 6.5)
  - Also includes previous fixes: CVE-2026-22778, CVE-2026-27893

- Upgrade transformers >=4.53.0 → >=5.0.0rc3
  - CVE-2026-1839: RCE via Trainer._load_rng_state (CVSS 7.2)
    - torch.load() without weights_only=True allows arbitrary code execution
  - Also includes previous fixes: CVE-2024-11393, multiple ReDoS, URL validation

File: rdagent/scenarios/rl/autorl_bench/requirements.txt

2026-04-11 21:45:53 +02:00

..

app

feat: Add GitHub infrastructure, CI/CD pipelines, and examples

2026-04-11 21:40:18 +02:00

components

feat: Add AI Strategy Builder (StrategyCoSTEER) - Closed Source

2026-04-05 19:30:12 +02:00

core

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

log

fix: Display litellm messages as info instead of warnings

2026-04-06 19:45:04 +02:00

oai

feat: Data Loader module with tests (P0 complete)

2026-04-09 08:15:49 +02:00

scenarios

fix(security): Upgrade vllm and transformers to patch 4 CVEs

2026-04-11 21:45:53 +02:00

utils

fix: Add Bandit security scanning and fix critical vulnerabilities

2026-04-03 11:55:05 +02:00