CVE-2026-126192

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10.

• CWE-400
• CWE-407

• https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0
• https://github.com/facelessuser/soupsieve/pull/304
• https://github.com/facelessuser/soupsieve/releases/tag/2.10
• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4
• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4

Published

Nov 12, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126187React is a JavaScript library for building user interfaces. …9.5
• CVE-2026-126188Active Storage makes it simple to upload and reference files…3.7
• CVE-2026-126189Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-12619Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-126190Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-126191Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-126193Soup Sieve is a CSS selector library for Beautiful Soup. Fro…5.3
• CVE-2026-126196pgEdge Postgres MCP Server enables SQL queries against Postg…8.1
• CVE-2026-126197pgEdge Postgres MCP Server enables SQL queries against Postg…8.8
• CVE-2026-126198pgEdge Postgres MCP Server enables SQL queries against Postg…3.1
• CVE-2026-126199pgEdge Postgres MCP Server enables SQL queries against Postg…6.8
• CVE-2026-1262IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …4.3