CVE-2026-126190 · Package
NO FIX YET · SEE WHAT TO DO
Soup Sieve is the CSS selector library used with Beautiful Soup 4. Descendant selectors such as `section div div` re-walk ancestors on deeply nested untrusted HTML or XML, so an attacker can tie up a worker for seconds or minutes.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that run Beautiful Soup CSS selectors with descendant combinators against untrusted HTML or XML are exposed. Processing only trusted documents is not affected, and selectors compiled with NOCACHE keep the old uncached behavior.
Not affected if no-descendant-selectors, trusted-documents-only
Who cares beautifulsoup, python, web-scraping
pip show soupsieveselect(, select_one( or other Beautiful Soup CSS selector calls run on untrusted documents4.0 or laterSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.