CVE-2026-126192

Name of the Vulnerable Software and Affected Versions Soup Sieve versions prior to 2.10

Description Matching a developer-authored selector that places the general sibling combinator inside the :has() pseudo-class repeatedly scans each candidate element's following siblings when the right-hand side is absent. This behavior results in quadratic work when processing attacker-controlled HTML. Applications evaluating a fixed selector, such as div:has(a ~ b), over untrusted markup may experience worker exhaustion for several minutes even with small documents.

Recommendations Update Soup Sieve to version 2.10.