Python dependency update (MINDBREEZE43943)

ID: MINDBREEZE43943 
Affected Components: Mindbreeze InSpire, Mindbreeze InSpire SaaS 
Severity: 8.7 High 
Status: Final 
First published: September 9, 2026 
CVEs: CVE-2025-14929, CVE-2026-1839, CVE-2026-2654, CVE-2026-34993, CVE-2026-41066, CVE-2026-4372, CVE-2026-44405, CVE-2026-44431, CVE-2026-44432, CVE-2026-44512, CVE-2026-44843, CVE-2026-45134, CVE-2026-45409, CVE-2026-47265, CVE-2026-48155, CVE-2026-48156, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, CVE-2026-48710, CVE-2026-48735, CVE-2026-48775, CVE-2026-48776, CVE-2026-48817, CVE-2026-48818, CVE-2026-49460, CVE-2026-49461, CVE-2026-49476, CVE-2026-49477, CVE-2026-4963, CVE-2026-50269, CVE-2026-5241, CVE-2026-52869, CVE-2026-52870, CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540, CVE-2026-54058, CVE-2026-54059, CVE-2026-54060, CVE-2026-54273, CVE-2026-54274, CVE-2026-54275, CVE-2026-54276, CVE-2026-54277, CVE-2026-54278, CVE-2026-54279, CVE-2026-54280, CVE-2026-54282, CVE-2026-54283, CVE-2026-54530, CVE-2026-54531, CVE-2026-54651, CVE-2026-55379, CVE-2026-55380, CVE-2026-55443, CVE-2026-55798, CVE-2026-57204, CVE-2026-58203, CVE-2026-59152, CVE-2026-59197, CVE-2026-59198, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205, CVE-2026-59890, CVE-2026-59935, CVE-2026-59936, CVE-2026-59937, CVE-2026-59938, CVE-2026-59950, CVE-2026-63632, CVE-2026-7246, CVE-2026-8643, GHSA-537c-gmf6-5ccf 

Summary 

* Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
* A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution.
* Hugging Face Smolagents has a Server-Side Request Forgery issue
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.
* lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files.
* A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID.
* Paramiko rsakey.py allows the SHA-1 algorithm
* urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
* urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion.
* ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
* LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
* LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
* Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.
* pypdf: Possible large memory usage for large offsets for layout mode text
* pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams
* PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
* PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
* PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
* PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
* PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
* Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
* pypdf: Manipulated XMP metadata streams can exhaust RAM
* LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading
* LangGraph SDK has unsafe URL path construction
* Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs.
* Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404.
* pypdf: Inefficient decoding of FlateDecode PNG predictor streams
* pypdf: Possible large memory usage for form XObjects during text extraction
* Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
* Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
* Hugging Face Smolagents has an Injection issue
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.
* A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization.
* MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
* MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
* python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
* python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
* python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
* python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
* Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
* Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
* Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status.
* AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write.
* Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled.
* Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded.
* pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
* pypdf: Possible infinite loop when processing outlines/bookmarks in writer
* pypdf: Possible infinite loop when processing threads/articles in writer
* Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
* Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
* LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory.
* Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
* pypdf: Missing stream length values ignore defined limits
* pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
* LangSmith SDK TracingMiddleware: Arbitrary server-side file read
* Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic.
* Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
* Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
* Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
* Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
* Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
* Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
* setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
* pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
* pypdf: Possible infinite loop for not terminated inline images
* pypdf: Possible long runtimes for repeated malformed cross-reference entries
* pypdf: Possible large memory usage for wrong image dimensions
* MCP Python SDK: WebSocket server transport does not support Host/Origin validation
* ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
* Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
* pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
* Vulnerable OpenSSL included in cryptography wheels 

Hotfix Information 

Fixed with following versions of Mindbreeze InSpire On-Premises or Mindbreeze InSpire SaaS: 

• Mindbreeze InSpire 26.5 Release
• Mindbreeze InSpire SaaS 26.5 Release