CVE-2026-126189 · Package
NO FIX YET · SEE WHAT TO DO
Soup Sieve is a CSS selector library used with Beautiful Soup 4. Before 4.0.1, evaluating :has() selectors against deeply nested or wide untrusted HTML or XML takes quadratic time, so an attacker can keep a worker busy for seconds or minutes.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that run Beautiful Soup CSS selectors, especially ones using :has(), against untrusted HTML or XML are exposed to slow matching and a stalled worker. Applications that only process trusted documents are not affected, and selectors compiled with NOCACHE keep the old uncached behavior.
Not affected if no-has-selectors, trusted-documents-only
Who cares beautifulsoup, python, soupsieve, web-scraping
pip show soupsieve.soupsieve or beautifulsoup4 to find where it is pulled in.4.0.1Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.