CSS Selector Library Soup Sieve Vulnerability in Beautiful Soup 4

CVE-2026-126189

What is CVE-2026-126189?

The Soup Sieve library, utilized by Beautiful Soup 4 for CSS selection, is vulnerable due to inefficiencies in evaluating CSS selectors. Prior to version 4.0.1, the library employed a flawed method wherein descendant subtrees were repeatedly searched and parent elements containing specific selectors were re-evaluated, leading to significant performance degradation when processing deeply nested or attacker-modified HTML and XML documents. Applications relying on fixed selectors against untrusted content could experience prolonged worker occupation, with delays ranging from seconds to minutes. Users processing only trusted documents remain unaffected. This inefficiency is addressed in the subsequent release of version 4.0.1.

References