CVE-2026-126189

Name of the Vulnerable Software and Affected Versions Soup Sieve versions prior to 4.0.1

Description Soup Sieve, a CSS selector library for Beautiful Soup 4, contains an issue where it repeatedly searches descendant subtrees for each candidate evaluated by :has() and reevaluates parents containing :has(> ...) for each child. This leads to quadratic matching when processing deeply nested or wide HTML or XML documents influenced by an attacker. Applications using select(), select one(), or Beautiful Soup CSS APIs against untrusted documents may experience worker occupancy for seconds or minutes. Selectors compiled with NOCACHE maintain the old uncached behavior.

Recommendations Update Soup Sieve to version 4.0.1.