andre/crewAI
1
0
Fork 0
mirror of https://github.com/crewAIInc/crewAI.git synced 2026-08-10 08:21:54 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

fix: upgrade nltk to 3.10.0 to resolve path traversal vulnerabilities

Browse Source 
Upgrades nltk from 3.9.4 to 3.10.0 which fixes three path traversal
vulnerabilities (GHSA-qvv7-cg9c-w4x3, GHSA-fg7f-2386-8897,
GHSA-xh95-f55m-82fw) that were causing the pip-audit CI job to fail.

Also removes the now-obsolete PYSEC-2026-597 ignore entry from the
vulnerability-scan workflow since the vulnerability is fixed in 3.10.0.
This commit is contained in:
copilot-swe-agent[bot]
2026-08-03 11:31:36 +00:00
committed by GitHub
parent f9aef7f93c
commit 075829c5fb
2 changed files with 52 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.github/workflows/vulnerability-scan.yml vendored
View File

@@ -53,7 +53,6 @@ jobs:
--skip-editable
--format json
--output pip-audit-report.json
--ignore-vuln PYSEC-2026-597 # nltk 3.9.4 (CVE-2026-12243): no fix available, transitive through crewai-tools[xml] -> unstructured.
--ignore-vuln GHSA-rrmf-rvhw-rf47 # torch 2.12.0 (CVE-2025-3000): local-only memory corruption in torch.jit.script; no fix available.
--ignore-vuln GHSA-f4j7-r4q5-qw2c # chromadb 1.1.1 (CVE-2026-45829): pre-auth RCE in the HTTP server; no fix available.
)