Performance Degradation in Soup Sieve CSS Selector Library by Faceless User

CVE-2026-126192

What is CVE-2026-126192?

The Soup Sieve library, utilized with Beautiful Soup 4, contains a vulnerability that allows for significant performance degradation when processing untrusted HTML with certain CSS selectors. Specifically, prior to version 2.10, a developer-defined selector utilizing the general sibling combinator within :has() can lead to excessive processing time, as the library repeatedly scans through candidates' siblings when the selector's right-hand side is missing. This can result in a worker being occupied for extended periods over seemingly small documents, demonstrating how untrusted markup can introduce serious delays in application performance. The issue is addressed in version 2.10, where improvements were implemented to mitigate these concerns.

References