diff --git a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
index 136c97bb..10780bb3 100644
--- a/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
+++ b/rdagent/scenarios/rl/autorl_bench/benchmarks/webshop/requirements.txt
@@ -27,5 +27,5 @@ spacy==3.7.2
 # Note: Flask/Werkzeug pinned to 2.x (Flask 3.x incompatible with WebShop)
 # Security Note: CVE-2024-34069 affects Werkzeug debugger (dev mode only)
 # Mitigation: Never run with debug=True in production; benchmark runs locally
-flask==2.2.5
+flask==3.1.3
 Werkzeug==2.3.8  # Latest 2.x with security patches
\ No newline at end of file