zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-07-29 12:09:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: remediate nltk CVEs by constraining to >=3.10.0 (#17443)

Browse Source 
## Summary
  
Remediates five nltk CVEs by adding `nltk>=3.10.0` to
`constraint-dependencies` in `pyproject.toml`.
  
  | CVE | Severity | Installed | Fixed in |
  |---|---|---|---|
  | CVE-2025-14009 | CRITICAL | 3.9.2 | 3.9.3 |
  | CVE-2026-0846 | HIGH | 3.9.2 | 3.9.3 |
  | CVE-2026-0847 | HIGH | 3.9.2 | — |
  | CVE-2026-33231 | HIGH | 3.9.2 | 3.9.4 |
  | CVE-2026-33236 | HIGH | 3.9.2 | — |
  | CVE-2026-54293 | HIGH | 3.9.2 | 3.10.0 |
  | CVE-2026-33230 | MEDIUM | 3.9.2 | 3.9.4 |
  
  CVE-2026-0847 and CVE-2026-33236 have no confirmed fixed version.
 
`nltk` is a transitive dependency (pulled in by `crawl4ai` and
`infinity-sdk`). No package in the graph caps it below 3.10.0. It was
stuck at 3.9.2 simply because the lockfile had never been re-resolved.
This commit is contained in:
rayhan
2026-07-27 13:38:49 +01:00
committed by GitHub
parent f9e47ae0b9
commit 1ae1dd1edb
2 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pyproject.toml
View File

@@ -226,6 +226,10 @@ constraint-dependencies = [
# inscriptis 2.7.0 pins lxml<6.0.0, blocking the lxml CVE fix;
# 2.7.3 relaxes to <6.2.0. Pulled in transitively via ir-datasets -> ranx
"inscriptis>=2.7.3",
# CVE-2025-14009 (CRITICAL), CVE-2026-0846, CVE-2026-0847, CVE-2026-33231,
# CVE-2026-33236, CVE-2026-54293 (HIGH), CVE-2026-33230 (MEDIUM):
# nltk < 3.10.0 vulnerable; pulled in transitively via crawl4ai, infinity-sdk
"nltk>=3.10.0",
]
exclude-dependencies = [
# crawl4ai>=0.8.6 depends on unclecode-litellm, which installs the same