Soup Sieve ReDoS vulnerability CVE-2026-126191: upgrade to a patched version

GitHub Advisories published advisory GHSA-6655-6qjp-jx7x for ReDoS vulnerability CVE-2026-126191 in Soup Sieve. The flaw occurs during CSS selector compilation and is relevant to applications processing user-supplied selectors.

Overview and technical details

Soup Sieve is a Python library for parsing and selecting HTML elements with CSS selectors, including when BeautifulSoup calls it through .select(). The vulnerability is in the selector compilation process.

Affected systems

The risk is relevant when an application compiles untrusted CSS selectors supplied by users, such as a web scraping service or a tool that lets users define extraction rules.

Mechanism and impact

The IDENTIFIER/CSS_ESCAPES regex in css_parser.py:119-124 can backtrack exponentially when compiling a valid selector containing an ambiguous digit-escape string such as \9 in an attribute or tag name. The issue occurs before SELECTOR_LIMIT is checked; a selector of about 60 bytes can hang a worker, causing denial of service.

It can be triggered through soupsieve.compile() or BeautifulSoup .select() when an application passes a user-supplied selector for compilation.

System checks

1. Check the installed Soup Sieve version in the Python environment:

   Copy commands

   python -m pip show soupsieve

   Version 3.0.2 or later includes the fix; version 2.10 and earlier needs upgrading.

Remediation and mitigation

1. Upgrade pip:soupsieve to version 3.0.2 or later, prioritizing applications that compile untrusted CSS selectors.

2. Do not use version 3.0.0 to upgrade: it fixed the issue but was withdrawn from PyPI.

3. After upgrading, rerun the version check and confirm that the installed package is version 3.0.2 or later.