From 6bcf97aebcf23e9998b4876b375c8c8879f63bec Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 16:33:11 +0000 Subject: [PATCH 1/2] chore(ci): ignore unpatched nltk GHSA-8mgp-746c-j5xp No patched PyPI release exists beyond 3.10.3. nltk is transitive via crewai-tools[xml] -> unstructured; CrewAI does not call the vulnerable model-artifact APIs. Co-authored-by: Vidit Ostwal --- .github/workflows/vulnerability-scan.yml | 5 +++++ .pre-commit-config.yaml | 3 ++- lib/crewai-tools/pyproject.toml | 6 ++++-- pyproject.toml | 5 ++++- 4 files changed, 15 insertions(+), 4 deletions(-) diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml index 0feeb04a56..db30426be7 100644 --- a/.github/workflows/vulnerability-scan.yml +++ b/.github/workflows/vulnerability-scan.yml @@ -100,6 +100,11 @@ jobs: # GHSA-xph7-9rjv-w5fr (CVE-2026-45831): SimpleRBACAuthorizationProvider # ignores tenant/database/collection scope. --ignore-vuln GHSA-xph7-9rjv-w5fr + # nltk <=3.10.3: GHSA-8mgp-746c-j5xp (CVE-2026-81726): model-artifact + # APIs bypass pathsec and read/write outside allowed roots. No patched + # PyPI release yet (fixes are on nltk develop only). Transitive via + # crewai-tools[xml] -> unstructured; CrewAI does not call those APIs. + --ignore-vuln GHSA-8mgp-746c-j5xp ) uv run pip-audit "${pip_audit_args[@]}" continue-on-error: true diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 8a005564bf..af00393f3a 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -59,7 +59,8 @@ repos: --ignore-vuln GHSA-f4j7-r4q5-qw2c --ignore-vuln GHSA-2wm9-hf6c-p5cr --ignore-vuln GHSA-36p7-vc44-83pf - --ignore-vuln GHSA-xph7-9rjv-w5fr' -- + --ignore-vuln GHSA-xph7-9rjv-w5fr + --ignore-vuln GHSA-8mgp-746c-j5xp' -- language: system pass_filenames: false stages: [pre-push, manual] diff --git a/lib/crewai-tools/pyproject.toml b/lib/crewai-tools/pyproject.toml index 908bd5cf06..6a22f88a0b 100644 --- a/lib/crewai-tools/pyproject.toml +++ b/lib/crewai-tools/pyproject.toml @@ -123,8 +123,10 @@ xml = [ "unstructured[local-inference, all-docs]>=0.17.2", # unstructured allows nltk>=3.9.2, but <3.10.3 still has PYSEC-2026-3726 # (symlink file read in IPIPANCorpusReader; 3.10.0-3.10.1) plus later - # 3.10.2 findings. Declared here, not only as a uv override, so consumers - # installing crewai-tools[xml] get the fixed version. + # 3.10.2 findings. 3.10.3 still has unpatched GHSA-8mgp-746c-j5xp + # (ignored in pip-audit until a release ships). Declared here, not only + # as a uv override, so consumers installing crewai-tools[xml] get this + # floor. "nltk>=3.10.3", ] oxylabs = [ diff --git a/pyproject.toml b/pyproject.toml index d3e8a4f6a9..0fcf38a46b 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -226,7 +226,10 @@ exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings = # 3.9.4, so that ignore is no longer needed. 3.10.0-3.10.1 have PYSEC-2026-3726 # (symlink-based arbitrary file read in IPIPANCorpusReader); fixed in 3.10.2. # 3.10.3 also clears later 3.10.2 findings (proxy SSRF, pickle allowlist RCE, -# JVM option injection, XML entity expansion). Transitive via +# JVM option injection, XML entity expansion). 3.10.3 still has +# GHSA-8mgp-746c-j5xp (CVE-2026-81726; model-artifact pathsec bypass); no +# patched PyPI release yet, so that GHSA is ignored in pip-audit until one +# ships. Transitive via # crewai-tools[xml] -> unstructured. # pydantic-settings <2.14.2 has GHSA-4xgf-cpjx-pc3j. # h2 <=4.4.0 has GHSA-6hr6-w5qg-qmwg (CVE-2026-71554): duplicate Host headers From 31a4ef4126d290a8cadb1d80fe06b72c35ba06a5 Mon Sep 17 00:00:00 2001 From: ViditOstwal Date: Wed, 2 Sep 2026 22:12:47 +0530 Subject: [PATCH 2/2] chore(ci): note dropping nltk GHSA ignore on the next bump Leave an explicit TODO beside the ignore so GHSA-8mgp-746c-j5xp is removed when nltk moves past the unpatched 3.10.3 floor. --- .github/workflows/vulnerability-scan.yml | 2 ++ .pre-commit-config.yaml | 1 + lib/crewai-tools/pyproject.toml | 6 +++--- pyproject.toml | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml index db30426be7..8311a269ec 100644 --- a/.github/workflows/vulnerability-scan.yml +++ b/.github/workflows/vulnerability-scan.yml @@ -104,6 +104,8 @@ jobs: # APIs bypass pathsec and read/write outside allowed roots. No patched # PyPI release yet (fixes are on nltk develop only). Transitive via # crewai-tools[xml] -> unstructured; CrewAI does not call those APIs. + # TODO: drop this ignore when bumping nltk past 3.10.3 to a patched + # release; keep the ignore list in sync with .pre-commit-config.yaml. --ignore-vuln GHSA-8mgp-746c-j5xp ) uv run pip-audit "${pip_audit_args[@]}" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index af00393f3a..1c9c187ac9 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -29,6 +29,7 @@ repos: - id: pip-audit name: pip-audit # Keep this ignore list in sync with .github/workflows/vulnerability-scan.yml. + # TODO: drop --ignore-vuln GHSA-8mgp-746c-j5xp when bumping nltk past 3.10.3. entry: >- bash -c 'source .venv/bin/activate && uv run pip-audit --skip-editable --ignore-vuln PYSEC-2024-277 diff --git a/lib/crewai-tools/pyproject.toml b/lib/crewai-tools/pyproject.toml index 6a22f88a0b..ab17af65b5 100644 --- a/lib/crewai-tools/pyproject.toml +++ b/lib/crewai-tools/pyproject.toml @@ -124,9 +124,9 @@ xml = [ # unstructured allows nltk>=3.9.2, but <3.10.3 still has PYSEC-2026-3726 # (symlink file read in IPIPANCorpusReader; 3.10.0-3.10.1) plus later # 3.10.2 findings. 3.10.3 still has unpatched GHSA-8mgp-746c-j5xp - # (ignored in pip-audit until a release ships). Declared here, not only - # as a uv override, so consumers installing crewai-tools[xml] get this - # floor. + # (ignored in pip-audit until a release ships). TODO: drop that ignore + # when bumping nltk past 3.10.3. Declared here, not only as a uv + # override, so consumers installing crewai-tools[xml] get this floor. "nltk>=3.10.3", ] oxylabs = [ diff --git a/pyproject.toml b/pyproject.toml index 0fcf38a46b..52b4b876c2 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -229,7 +229,8 @@ exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings = # JVM option injection, XML entity expansion). 3.10.3 still has # GHSA-8mgp-746c-j5xp (CVE-2026-81726; model-artifact pathsec bypass); no # patched PyPI release yet, so that GHSA is ignored in pip-audit until one -# ships. Transitive via +# ships. TODO: drop --ignore-vuln GHSA-8mgp-746c-j5xp when bumping nltk +# past 3.10.3. Transitive via # crewai-tools[xml] -> unstructured. # pydantic-settings <2.14.2 has GHSA-4xgf-cpjx-pc3j. # h2 <=4.4.0 has GHSA-6hr6-w5qg-qmwg (CVE-2026-71554): duplicate Host headers