CSS Selector Library Vulnerability in Beautiful Soup 4 by FacelessUser

CVE-2026-126190

What is CVE-2026-126190?

The Soup Sieve library, used with Beautiful Soup 4 for CSS selector parsing, contains a vulnerability that causes performance degradation when processing deeply nested attacker-controlled HTML or XML documents. This issue arises due to the library walking the same ancestor nodes repeatedly while matching descendant combinators. As a result, applications using certain selectors against untrusted documents may experience significant delays, with workers potentially being occupied for extended periods of time. Users are advised to upgrade to version 4.0 to mitigate this issue.

References