CVE-2026-126189

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.

• CWE-407

• https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379
• https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44
• https://github.com/facelessuser/soupsieve/pull/352
• https://github.com/facelessuser/soupsieve/releases/tag/4.0.1
• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-8jvp-3x96-xpqw

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126183A authorization bypass through user-controlled key vulnerabi…8.7
• CVE-2026-126184A authentication bypass by spoofing vulnerability in Fortine…8.2
• CVE-2026-126185A improper control of generation of code ('code injection') …7.2
• CVE-2026-126186Active Storage makes it simple to upload and reference files…8.8
• CVE-2026-126187React is a JavaScript library for building user interfaces. …9.5
• CVE-2026-126188Active Storage makes it simple to upload and reference files…3.7
• CVE-2026-12619Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-126190Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-126191Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-126192Soup Sieve is a CSS selector library designed to be used wit…6.3
• CVE-2026-126193Soup Sieve is a CSS selector library for Beautiful Soup. Fro…5.3
• CVE-2026-126196pgEdge Postgres MCP Server enables SQL queries against Postg…8.1