fix: CVEs, fixed pillow's, allowed pytorch's

Signed-off-by: DWarez <dario.salvati@huggingface.co>

Author: dwarez

docker/huggingface/pytorch/Dockerfile

@@ -37,8 +37,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
 # --- HuggingFace training stack ------------------------------------------
-# soupsieve floor is a CVE backport (GHSA-2wc2-fm75-p42x, GHSA-836r-79rf-4m37:
-# ReDoS in the CSS selector parser), flagged by the ECR scan on this base.
+# Security floors for ECR findings: soupsieve fixes GHSA-2wc2-fm75-p42x and
+# GHSA-836r-79rf-4m37; Pillow 12.3.0 fixes CVE-2026-55379.
 RUN uv pip install --python ${VENV_PYTHON} \
   transformers==${TRANSFORMERS_VERSION} \
   huggingface-hub==${HUGGINGFACE_HUB_VERSION} \
@@ -53,6 +53,7 @@ RUN uv pip install --python ${VENV_PYTHON} \
   "vllm==${VLLM_VERSION}" \
   "math-verify==${MATH_VERIFY_VERSION}" \
   sentencepiece protobuf einops scipy scikit-learn tensorboard \
+  "pillow>=12.3.0" \
   "soupsieve>=2.8.4" \
   && uv cache clean
 

test/security/data/ecr_scan_allowlist/huggingface-pytorch/framework_allowlist.json

@@ -0,0 +1,7 @@
+[
+    {
+        "vulnerability_id": "CVE-2026-24747",
+        "reason": "Inspector matched torch 2.9.1 only in /opt/venv/lib/python3.12/site-packages/benchmarks/requirements.txt; the installed runtime is torch 2.11.0 from the PyTorch 2.11.0 base image, so the vulnerable package version is not present. Remove this entry when the upstream package stops shipping the stale benchmark manifest.",
+        "review_by": "2026-10-31"
+    }
+]