{"schema_version":"1.9.2","id":"GHSA-6655-6qjp-jx7x","published":"2026-11-13T16:39:43Z","modified":"2026-11-13T16:45:03.387641194Z","aliases":["CVE-2026-126191"],"summary":"Soup Sieve: Exponential ReDoS in selector compilation via \\9-run in CSS_ESCAPES/IDENTIFIER","details":"### Summary\nThe IDENTIFIER/CSS_ESCAPES regex (css_parser.py:119-124) exhibits exponential backtracking on a run of ambiguous digit-escapes (`\\9`) in an attribute-name or tag position of an otherwise well-formed selector. It fires at compile time (before the SELECTOR_LIMIT guard) via the public `soupsieve.compile()` and BeautifulSoup `.select()`.\n\n### PoC (verified on soupsieve 2.9.2)\n\n    import soupsieve as sv\n    sv.compile('[a' + '\\\\9'*26 + '=x]')   # ~57 bytes -> ~10s; ~16x time per +4 chars\n\n### Novelty\nDistinct from the patched GHSA-836r-... (VALUE regex) and GHSA-2wc2-... (comma-list) advisories, which are fixed in 2.9.2; this is a different regex/vector.\n\n### Reachability\nCSS selectors are usually developer-controlled, so exposure requires an application that compiles UNTRUSTED selector strings (web-scraping-as-a-service, no-code/query builders, user-defined extraction rules). Where selectors are user-supplied, a ~60-byte string hangs the worker.\n\n### Note\nThis issue was fixed in version 3.0.0, which has been yanked from the PyPI registry. Use versions 3.0.2 and above to upgrade.","affected":[{"package":{"name":"soupsieve","ecosystem":"PyPI","purl":"pkg:pypi/soupsieve"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2"}]}],"versions":["0.4","0.5","0.5.1","0.5.2","0.5.3","0.6","1.0","1.0.1","1.0.2","1.0b1","1.0b2","1.1","1.2","1.2.1","1.3","1.3.1","1.4","1.5","1.6","1.6.1","1.6.2","1.7","1.7.1","1.7.2","1.7.3","1.8","1.9","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","2.0","2.0.1","2.1","2.10","2.2","2.2.1","2.3","2.3.1","2.3.2","2.3.2.post1","2.4","2.4.1","2.5","2.6","2.7","2.8","2.8.1","2.8.2","2.8.3","2.8.4","2.9","2.9.1","2.9.2","3.0","3.0.1"],"database_specific":{"last_known_affected_version_range":"<= 2.10","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6655-6qjp-jx7x/GHSA-6655-6qjp-jx7x.json"}}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126191"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/pull/300"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/3.0"}],"database_specific":{"cwe_ids":["CWE-1333"],"github_reviewed":true,"github_reviewed_at":"2026-11-13T16:39:43Z","nvd_published_at":"2026-11-12T17:17:32Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}