CVE-2026-126192

UNKNOWN 0.0

Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10.

CWE	CWE-400 CWE-407
Vendor	facelessuser
Product	soupsieve
Published	Nov 12, 2026
Last Updated	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for facelessuser soupsieve

Be the first to know when new unknown vulnerabilities affecting facelessuser soupsieve are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

facelessuser / soupsieve

< 2.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4 github.com: https://github.com/facelessuser/soupsieve/pull/304 github.com: https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0 github.com: https://github.com/facelessuser/soupsieve/releases/tag/2.10