From 87cc51967d696e889738d7c6bd1b5130ad9e58ff Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 12 Sep 2026 04:21:20 +0000 Subject: [PATCH] fix: upgrade image pip to >=26.2.0 for CVE-2026-13346 The Trivy image scan reports pip in python:3.12-slim as vulnerable until 26.2.0. Upgrade pip before installing pandas so the published local image leaves a patched installer. Co-authored-by: Chris Grady --- Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index e221f6e..e508e2a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,7 +8,9 @@ WORKDIR /app RUN apt-get update && apt-get install -y --no-install-recommends busybox-static \ && rm -rf /var/lib/apt/lists/* -RUN pip install --no-cache-dir "pandas>=2.0.0" +# pip<26.2 is CVE-2026-13346 (path traversal from a malicious index). +RUN python -m pip install --no-cache-dir --upgrade "pip>=26.2.0" \ + && pip install --no-cache-dir "pandas>=2.0.0" COPY vhc_simplifier.py . COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh