Security: 13 known CVEs in examples/celery/requirements.txt

## Summary The `examples/celery/requirements.txt` file contains pinned dependency versions with **13 known security vulnerabilities** (1 HIGH, 11 MEDIUM, 1 LOW), identified via Trivy filesystem scan. ## Affected File `examples/celery/requirements.txt` — pip-compiled lockfile for the Celery example application. ## Vulnerabilities ### HIGH (1) | Package | CVE | Installed | Fixed | Description | |---------|-----|-----------|-------|-------------| | werkzeug | [CVE-2024-34069](https://avd.aquasec.com/nvd/cve-2024-34069) | 2.3.3 | 3.0.3 | Code execution on developer's machine via debugger | ### MEDIUM (11) | Package | CVE | Installed | Fixed | Description | |---------|-----|-----------|-------|-------------| | jinja2 | [CVE-2024-22195](https://avd.aquasec.com/nvd/cve-2024-22195) | 3.1.2 | 3.1.3 | HTML attribute injection via xmlattr | | jinja2 | [CVE-2024-34064](https://avd.aquasec.com/nvd/cve-2024-34064) | 3.1.2 | 3.1.4 | Non-attribute character acceptance in keys | | jinja2 | [CVE-2024-56201](https://avd.aquasec.com/nvd/cve-2024-56201) | 3.1.2 | 3.1.5 | Sandbox breakout through malicious filenames | | jinja2 | [CVE-2024-56326](https://avd.aquasec.com/nvd/cve-2024-56326) | 3.1.2 | 3.1.5 | Sandbox breakout through indirect reference to format method | | jinja2 | [CVE-2025-27516](https://avd.aquasec.com/nvd/cve-2025-27516) | 3.1.2 | 3.1.6 | Sandbox breakout through attr filter selecting format method | | werkzeug | [CVE-2023-46136](https://avd.aquasec.com/nvd/cve-2023-46136) | 2.3.3 | 2.3.8 | High resource consumption (DoS) | | werkzeug | [CVE-2024-49766](https://avd.aquasec.com/nvd/cve-2024-49766) | 2.3.3 | 3.0.6 | safe_join not safe on Windows | | werkzeug | [CVE-2024-49767](https://avd.aquasec.com/nvd/cve-2024-49767) | 2.3.3 | 3.0.6 | Resource exhaustion when parsing file data in forms | | werkzeug | [CVE-2025-66221](https://avd.aquasec.com/nvd/cve-2025-66221) | 2.3.3 | 3.1.4 | DoS via Windows device names in path segments | | werkzeug | [CVE-2026-21860](https://avd.aquasec.com/nvd/cve-2026-21860) | 2.3.3 | 3.1.5 | safe_join() allows Windows special device names with compound extensions | | werkzeug | [CVE-2026-27199](https://avd.aquasec.com/nvd/cve-2026-27199) | 2.3.3 | 3.1.6 | safe_join() allows Windows special device names | ### LOW (1) | Package | CVE | Installed | Fixed | Description | |---------|-----|-----------|-------|-------------| | flask | [CVE-2026-27205](https://avd.aquasec.com/nvd/cve-2026-27205) | 2.3.2 | 3.1.3 | Information disclosure via improper caching of session data | ## Previous Attempts - PR #5987 attempted to fix only CVE-2024-34069 (werkzeug) but was closed without merge (2026-04-09). This issue covers all 13 CVEs comprehensively. ## Proposed Fix Update the pinned versions in `examples/celery/requirements.txt`: - `flask` 2.3.2 → 3.1.3 - `werkzeug` 2.3.3 → 3.1.6 - `jinja2` 3.1.2 → 3.1.6 - `blinker` 1.6.2 → 1.9.0 (flask 3.x dependency) - `itsdangerous` 2.1.2 → 2.2.0 (flask 3.x dependency) - `markupsafe` 2.1.2 → 3.0.3 (compatible upgrade) ## Verification Trivy rescan after fix shows **0 vulnerabilities** across all severity levels. ## Scanner Tool: [Trivy](https://github.com/aquasecurity/trivy) v0.57.0, DB updated 2026-04-10