CSS Selector Library Vulnerability in Soup Sieve by Faceless User

CVE-2026-126191

What is CVE-2026-126191?

The Soup Sieve library, intended for use with Beautiful Soup 4, has a vulnerability in its handling of CSS selectors that allows for exponential backtracking. This issue arises from the CSS_ESCAPES and IDENTIFIER patterns, which can cause performance degradation when processing untrusted selector strings. When such strings are compiled through soupsieve.compile() or selected using Beautiful Soup’s select() function, a worker can be stalled or experience excessive delays. This vulnerability has been addressed in version 3.0 of Soup Sieve, enhancing the library's resilience against malformed CSS selectors and improving overall application performance.

References