CVE-2026-126192

Description

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10.

References

https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4

https://github.com/facelessuser/soupsieve/releases/tag/2.10

https://github.com/facelessuser/soupsieve/pull/304

https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124557

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS