potiuk commented on PR #72946: URL: https://github.com/apache/airflow/pull/72946#issuecomment-5652009021
The `Reject vulnerable dependency changes` failure here is [GHSA-8mgp-746c-j5xp](https://github.com/advisories/GHSA-8mgp-746c-j5xp) (CVE-2026-81726, high) on `uv.lock » [email protected]`. It's the only finding in that job, and it's a false alarm for us. **What the advisory is:** six nltk model-artifact APIs (`TransitionParser.train`/`parse`, `AveragedPerceptron.save`/`load`, `PerceptronTagger.save_to_json`, `save_maxent_params`) called builtin `open()` on a caller-supplied path instead of nltk's pathsec helpers, so an application that hands one of them an attacker-controlled path can read/write outside nltk's sandbox roots. **Why it doesn't affect Airflow:** 1. Airflow doesn't depend on nltk. It arrives only through `llama-index-core` (`Requires-Dist: nltk>=3.9.3`), which is itself the `llamaindex` optional extra plus dev group of `apache-airflow-providers-common-ai`. 2. It is not in any released constraint set — `nltk` appears only in `constraints-source-providers-*.txt`, never in `constraints-*.txt` or `constraints-no-providers-*.txt`. A user installing Airflow with constraints never gets it. 3. The vulnerable APIs are unreachable from that path. `llama_index/core` touches nltk in exactly two places: `utils.py` (`PunktSentenceTokenizer`, `corpus.stopwords`, `nltk.download` into its own bundled `_static/nltk_cache`) and `indices/keyword_table/utils.py` (optional `rake_nltk`). It never imports `TransitionParser`, `AveragedPerceptron`, `PerceptronTagger.save_to_json` or `save_maxent_params`. 4. Even where it is reachable, the bug is a defence-in-depth escape from nltk's own path sandbox and requires the *application* to pass an attacker-controlled model path. Airflow does none of that. **Why it won't clear on its own:** upstream has already merged the fix on nltk's `develop` (nltk/nltk#3757, nltk/nltk#3759, nltk/nltk#3813, merged 18–28 Aug) with a dedicated exploit-matrix test (`nltk/test/unit/test_model_artifact_pathsec.py`). But `v3.10.3` was tagged 12 Aug, *before* those commits, so no released version carries the fix and the advisory's "patched versions" field is empty. Of nltk's 37 published advisories this is the only one still unpatched — every other one is closed out at ≤ 3.10.3. It stays red until nltk cuts 3.10.4. Upstream tracker: nltk/nltk#3789. **Fixup:** added `allow-ghsas: GHSA-8mgp-746c-j5xp` to the dependency-review step, with a comment saying to drop it once 3.10.4 ships. Separate side note, not for this PR: this gate is the `Java SDK dependency security` workflow. It triggers on `java-sdk/**` and then reviews the *entire* PR dependency diff — including `uv.lock`, which has nothing to do with the Java SDK. That's why a Python-side advisory fails a Java SDK check. The `ts-sdk` equivalent avoids this by being pinned to `branches: main`. Probably worth scoping, but not in a release sync PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
