{"affected":[{"product":"soupsieve","source":"CNA: GitHub_M","vendor":"facelessuser","versions":[{"status":"affected","version":"< 2.10"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"soupsieve","product":"soupsieve","source":"OSV GHSA-4j63-6c4x-wfg4","vendor":"","versions":[{"status":"affected","version":"0.4","versionType":"PyPI"},{"status":"affected","version":"0.5","versionType":"PyPI"},{"status":"affected","version":"0.5.1","versionType":"PyPI"},{"status":"affected","version":"0.5.2","versionType":"PyPI"},{"status":"affected","version":"0.5.3","versionType":"PyPI"},{"status":"affected","version":"0.6","versionType":"PyPI"},{"status":"affected","version":"1.0","versionType":"PyPI"},{"status":"affected","version":"1.0.1","versionType":"PyPI"},{"status":"affected","version":"1.0.2","versionType":"PyPI"},{"status":"affected","version":"1.0b1","versionType":"PyPI"},{"status":"affected","version":"1.0b2","versionType":"PyPI"},{"status":"affected","version":"1.1","versionType":"PyPI"},{"status":"affected","version":"1.2","versionType":"PyPI"},{"status":"affected","version":"1.2.1","versionType":"PyPI"},{"status":"affected","version":"1.3","versionType":"PyPI"},{"status":"affected","version":"1.3.1","versionType":"PyPI"},{"status":"affected","version":"1.4","versionType":"PyPI"},{"status":"affected","version":"1.5","versionType":"PyPI"},{"status":"affected","version":"1.6","versionType":"PyPI"},{"status":"affected","version":"1.6.1","versionType":"PyPI"},{"status":"affected","version":"1.6.2","versionType":"PyPI"},{"status":"affected","version":"1.7","versionType":"PyPI"},{"status":"affected","version":"1.7.1","versionType":"PyPI"},{"status":"affected","version":"1.7.2","versionType":"PyPI"},{"status":"affected","version":"1.7.3","versionType":"PyPI"},{"status":"affected","version":"1.8","versionType":"PyPI"},{"status":"affected","version":"1.9","versionType":"PyPI"},{"status":"affected","version":"1.9.1","versionType":"PyPI"},{"status":"affected","version":"1.9.2","versionType":"PyPI"},{"status":"affected","version":"1.9.3","versionType":"PyPI"},{"status":"affected","version":"1.9.4","versionType":"PyPI"},{"status":"affected","version":"1.9.5","versionType":"PyPI"},{"status":"affected","version":"1.9.6","versionType":"PyPI"},{"status":"affected","version":"2.0","versionType":"PyPI"},{"status":"affected","version":"2.0.1","versionType":"PyPI"},{"status":"affected","version":"2.1","versionType":"PyPI"},{"status":"affected","version":"2.2","versionType":"PyPI"},{"status":"affected","version":"2.2.1","versionType":"PyPI"},{"status":"affected","version":"2.3","versionType":"PyPI"},{"status":"affected","version":"2.3.1","versionType":"PyPI"},{"status":"affected","version":"2.3.2","versionType":"PyPI"},{"status":"affected","version":"2.3.2.post1","versionType":"PyPI"},{"status":"affected","version":"2.4","versionType":"PyPI"},{"status":"affected","version":"2.4.1","versionType":"PyPI"},{"status":"affected","version":"2.5","versionType":"PyPI"},{"status":"affected","version":"2.6","versionType":"PyPI"},{"status":"affected","version":"2.7","versionType":"PyPI"},{"status":"affected","version":"2.8","versionType":"PyPI"},{"status":"affected","version":"2.8.1","versionType":"PyPI"},{"status":"affected","version":"2.8.2","versionType":"PyPI"},{"status":"affected","version":"2.8.3","versionType":"PyPI"},{"status":"affected","version":"2.8.4","versionType":"PyPI"},{"status":"affected","version":"2.9","versionType":"PyPI"},{"status":"affected","version":"2.9.1","versionType":"PyPI"},{"status":"affected","version":"2.9.2","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"2.10.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-126192","cwes":["CWE-400","CWE-407"],"description":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4"}],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.3,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794531606040,"publishedAt":1794503354205,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/facelessuser/soupsieve/pull/304"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/facelessuser/soupsieve/releases/tag/2.10"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/facelessuser/soupsieve/pull/304"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/facelessuser/soupsieve/releases/tag/2.10"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-4j63-6c4x-wfg4"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-4j63-6c4x-wfg4"}],"remediation":[{"kind":"fix","source":"OSV GHSA-4j63-6c4x-wfg4","text":"soupsieve (PyPI): OSV reports a fixed version 2.10.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-4j63-6c4x-wfg4"}],"revision":"fc9c8b7f93cacf74ab5e47603276562afb4005de08e9c8ad3cf240e9d4c47f0f","sources":[{"modifiedAt":1794529238658,"name":"CNA: GitHub_M","retrievedAt":1794532131510,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126192"},{"modifiedAt":1794510546967,"name":"NVD","retrievedAt":1794529522403,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126192"},{"modifiedAt":1794531606040,"name":"OSV / GitHub Security Advisories","retrievedAt":1794532132098,"url":"https://osv.dev/vulnerability/GHSA-4j63-6c4x-wfg4"}],"ssvc":{"assessedAt":1794529214507,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time","updatedAt":1794532132098}