Skip to content

Repository navigation

chore(deps): update dependency soupsieve to v4 [security] - #782

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-soupsieve-vulnerability
Open

chore(deps): update dependency soupsieve to v4 [security]#782
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-soupsieve-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

Important

Security fix, opened without the 5-day wait

Renovate opened this PR because a published advisory affects the current version. It skipped the minimum release age (minimumReleaseAge) check, so the fixed version might be younger than 5 days. Read the advisory below, check the release age and the upstream release, then merge by hand.

This exception is configured in renovate.json.

This PR contains the following updates:

Package Change Age Confidence
soupsieve 2.10 → 4.0 age confidence

Soup Sieve: Polynomial-time denial of service in the descendant combinator

CVE-2026-126190 / GHSA-mmhr-3c5m-f64f

More information

Details

Summary

Matching a selector that uses the descendant combinator (a b) takes time that grows polynomially with how deeply the document is nested, and each extra descendant combinator in the selector raises the degree by one. A selector with k descendant combinators takes O(n^(k+1)) time on a chain of n nested elements.

An attacker who controls the HTML or XML that an application passes to Soup Sieve (directly, or through Beautiful Soup's select(), select_one(), css.select(), etc.) can send a very small, deeply nested document that keeps a CPU busy for seconds to minutes against an ordinary selector such as section div div.

Details

To match a b, Soup Sieve checks each element against b and then walks up through its ancestors looking for one that matches a. When the selector has more descendant combinators, the rest of the selector is tried again from each ancestor on that walk, and so on for every combinator. Nothing was reused between walks, so the same ancestors were matched against the same part of the selector over and over.

The worst case is when the leftmost part of the selector never matches, as in section div div against a document of nested <div> with no <section>: every walk goes all the way to the root and no search can stop early.

Timings

Example timings with html.parser on Soup Sieve 3.0.4 and 4.0, using a document of nested <div> (5 bytes each) and no matches:

Nesting depth Input size Selector 3.0.4 4.0
2,000 10 KB section div 1.6 s 0.05 s
4,000 20 KB section div 5.1 s 0.01 s
400 2 KB section div div 6.7 s < 0.01 s
800 4 KB section div div 53.0 s < 0.01 s
100 0.5 KB section div div div 2.5 s < 0.01 s
200 1 KB section div div div 40.9 s < 0.01 s

None of these selectors use unusual syntax.

Proof of concept
import time
import bs4
import soupsieve as sv

soup = bs4.BeautifulSoup('<div>' * 200, 'html.parser')
t = time.process_time()
sv.select('section div div div', soup)
print(time.process_time() - t)

On affected versions, doubling the nesting depth multiplies the time by about 2^(k+1), where k is the number of descendant combinators: about 4x for section div, 8x for section div div, and 16x for section div div div.

Impact

Applications are affected if they run selectors with descendant combinators against documents that untrusted users can influence, such as scrapers, HTML sanitizers or filters, and services that process uploaded or fetched markup. Descendant combinators are among the most common parts of CSS selectors, and a document of about 1 KB is enough to tie up a worker for close to a minute. Applications that only run selectors against trusted documents are not affected.

Patches

Fixed in 4.0 by facelessuser/soupsieve#351. Whether an element is, or has an ancestor that is, a match for part of a selector depends only on its parent, so Soup Sieve now caches that result per element and relation for every element visited on the walk. Each descendant combinator is then linear in the size of the document. Results are unchanged, and ordinary documents are no slower.

Caching is enabled by default, so no changes are needed beyond upgrading. The NOCACHE flag is a temporary fallback for users who run into problems with caching, and it is planned for removal. It uses the old uncached matching, so selectors compiled with NOCACHE are still subject to polynomial time and shouldn't be used with descendant combinators on untrusted input.

Workarounds

If users can't upgrade:

  • Use as few descendant combinators as they can in selectors that run on untrusted documents. Where the structure of the
    document is known, the child combinator (a > b) only looks at the parent and is not affected.
  • Limit the size and nesting depth of untrusted documents before selecting on them.
  • Run selection on untrusted input with a time limit, for example in a worker process that can be stopped.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack

CVE-2026-126193 / GHSA-7g44-g9rc-x53w

More information

Details

Summary

The Soup Sieve CSS selector parser recurses once per level of nested pseudo-class selector (:is(), :not(), :where(), :has()) without any limit on nesting depth. An unauthenticated attacker who can supply a CSS selector string to soupsieve.compile(), soupsieve.select(), or Beautiful Soup's soup.select() / soup.select_one() can force the parser to exceed Python's recursion limit with a small crafted input (about 1.6 KB, roughly 330 nesting levels), raising an uncontrolled RecursionError. Because this exception is not part of the parser's documented error contract, applications that catch only ValueError or SelectorSyntaxError see an unexpected failure of the request or task that parsed the selector.

Root Cause

The parser dispatches each opening pseudo-class token to parse_pseudo_open, which calls back into parse_selectors to parse the pseudo-class body. Every nesting level therefore adds Python stack frames, and no counter, depth guard, or RecursionError handler bounds this descent. The token-count guard SELECTOR_LIMIT = 8192 (added for the earlier comma-separated-list memory issue) counts parsed tokens, not recursion depth; at the failing nesting depth the token count is only about 330, roughly four percent of that limit, so the guard never fires. The security invariant that untrusted selector input must not be able to exhaust interpreter resources is not enforced for nesting depth.

soupsieve/css_parser.py
  CSSParser.parse_pseudo_open (line 985): sel.selectors.append(self.parse_selectors(iselector, index, flags))
  CSSParser.parse_selectors  (line 1137): recursive target; dispatches pseudo-class tokens back into parse_pseudo_class -> parse_pseudo_open
  CSSParser.increment_count  (lines 707-712): SELECTOR_LIMIT token guard; increments once per nesting level, cannot bound depth
Impact

Any application that compiles or evaluates untrusted CSS selectors through Soup Sieve (directly or via Beautiful Soup) is affected. No authentication, privilege, or user interaction is required; the failure occurs during selector parsing, before any document is matched. A single crafted selector of about 1.6 KB reliably raises RecursionError. The demonstrated capability is a transient denial of the individual request, task, or invocation that parsed the malicious selector: the exception propagates uncaught unless the caller handles RecursionError (or a broad except Exception). The RecursionError in CPython 3.x is a recoverable stack unwind, not an interpreter crash or persistent resource exhaustion, and it carries no confidentiality or integrity impact. Applications following the parser's documented error pattern (catching ValueError / SelectorSyntaxError) will not catch it, so a repeated stream of such selectors can plausibly cause repeated per-request failures; this per-request availability effect is the demonstrated consequence, not a service-wide or amplified outage.

Proof of Concept

Requires only an installed Soup Sieve (any release from 0.4 through 2.10) and a default CPython recursion limit of 1000. No Beautiful Soup document or network setup is needed.

import soupsieve as sv

##### ~330 levels of nested :is() around a single tag: about 1.6 KB of input.
depth = 330
selector = ":is(" * depth + "a" + ")" * depth
print("selector length:", len(selector))
sv.compile(selector)
selector length: 1651
Traceback (most recent call last):
  ...
  File ".../soupsieve/css_parser.py", line 985, in parse_pseudo_open
    sel.selectors.append(self.parse_selectors(iselector, index, flags))
RecursionError: maximum recursion depth exceeded

The same failure was reproduced with :not(), :where(), and :has(), and through BeautifulSoup(...).select(selector). A negative control at depth 100 compiles successfully with a token count of 101, confirming the token guard is far from firing.

Attack Chain
  1. Exposure: The application exposes soupsieve.compile() / select() or Beautiful Soup's .select() / .select_one() to attacker-influenced CSS selector input. These are the library's primary public API and ship enabled by default; Soup Sieve is an automatic dependency of Beautiful Soup 4.
  2. Control: The attacker fully controls the selector string. The nested pseudo-class pattern (:is(:is(...a...))) survives tokenization and normalization unchanged.
  3. Path: compile() reaches CSSParser.process_selectors() and then parse_selectors(), which dispatches each pseudo-class token through parse_pseudo_class() into parse_pseudo_open(), which calls parse_selectors() again, once per nesting level.
  4. Guard: The only resource guard is the SELECTOR_LIMIT token counter, which reaches about 330 at the failing depth versus its limit of 8192, so it never fires. No recursion-depth counter and no RecursionError handler exist anywhere in the package.
  5. Primitive: Python's recursion limit is exceeded during parsing, raising an uncontrolled RecursionError.
  6. Result: The unhandled RecursionError propagates to the caller, failing the request, task, or process invocation that parsed the selector, outside the parser's documented ValueError / SelectorSyntaxError error contract.
Bypass Evidence

The relevant existing guard is the SELECTOR_LIMIT = 8192 token counter in increment_count(). It does not block this path: it increments once per nesting level, so at the failing depth of about 330 the count is roughly 330 (about four percent of 8192), verified by instrumenting increment_count and observing a maximum count of 329 at the point RecursionError was raised. A search of the package for RecursionError and RuntimeError handlers returns no matches, so nothing catches the error internally, and functools.lru_cache on the compile path does not cache exceptions. Attempts to invalidate the finding were made and failed: raising the interpreter recursion limit only shifts the required nesting depth (a proportionally larger but still small selector), and a broad except Exception in the caller does catch the error but the parser's documented contract raises only ValueError / SelectorSyntaxError, so callers coded to that contract remain exposed. This is a distinct weakness from the prior comma-separated-list memory-exhaustion advisory: that issue exhausts heap memory through linear object expansion and was addressed by the token count limit, whereas this issue exhausts the call stack through unbounded recursion depth and is not addressed by any released version, including 2.8.4 which was independently confirmed to still raise RecursionError on this input.

Affected Versions
  • Ecosystem: pip (PyPI)
  • Package: soupsieve
  • Confirmed affected range: >= 0.4, <= 2.10
  • Latest release checked: soupsieve 2.10 (PyPI, latest published release as of 2026-09-25)
  • Fix status: not fixed in any released version

The recursive parse_pseudo_open to parse_selectors structure is present in the earliest PyPI release (0.4) and in every subsequent release through the current 2.10, verified against the published PyPI source artifacts. Version 2.5, release 2.8.4 (which added that token-count limit), and 2.10 were each executed and confirmed to raise RecursionError on the crafted input. No released version adds a recursion-depth limit; the token-count SELECTOR_LIMIT introduced in 2.8.4 is architecturally unable to bound nesting depth. There is no registry or tag disagreement and no package or module path change.

Possible Solution

Python's RecursionError is sometimes a contested issue related to security. The Soup Sieve project does not consider it "uncontrolled" and allows it to be raised to indicate Python's maximum recursion depth was reached, and allows it to fail to prevent overflows, a much worse and real security vulnerability. With that said, the algorithm can be reworked to be non-recursive, allowing the selector limit check to now capture and raise an exception. In addition, the limit could be exposed to the user to give them better control.

Mitigation

For those on older versions where the algorithm is still recursive, a try/except block that captures RecursionError can be added around calls if accepting untrusted user input is allowed.

Note

This issue was fixed in version 3.0.0, which has been yanked from the PyPI registry. Use versions 3.0.2 and above to upgrade.

Reported by zx (GitHub: @​manus-pi).

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

CVE-2026-126191 / GHSA-6655-6qjp-jx7x

More information

Details

Summary

The IDENTIFIER/CSS_ESCAPES regex (css_parser.py:119-124) exhibits exponential backtracking on a run of ambiguous digit-escapes (\9) in an attribute-name or tag position of an otherwise well-formed selector. It fires at compile time (before the SELECTOR_LIMIT guard) via the public soupsieve.compile() and BeautifulSoup .select().

PoC (verified on soupsieve 2.9.2)
import soupsieve as sv
sv.compile('[a' + '\\9'*26 + '=x]')   # ~57 bytes -> ~10s; ~16x time per +4 chars
Novelty

Distinct from the patched GHSA-836r-... (VALUE regex) and GHSA-2wc2-... (comma-list) advisories, which are fixed in 2.9.2; this is a different regex/vector.

Reachability

CSS selectors are usually developer-controlled, so exposure requires an application that compiles UNTRUSTED selector strings (web-scraping-as-a-service, no-code/query builders, user-defined extraction rules). Where selectors are user-supplied, a ~60-byte string hangs the worker.

Note

This issue was fixed in version 3.0.0, which has been yanked from the PyPI registry. Use versions 3.0.2 and above to upgrade.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

CVE-2026-126191 / GHSA-6655-6qjp-jx7x

More information

Details

Summary

The IDENTIFIER/CSS_ESCAPES regex (css_parser.py:119-124) exhibits exponential backtracking on a run of ambiguous digit-escapes (\9) in an attribute-name or tag position of an otherwise well-formed selector. It fires at compile time (before the SELECTOR_LIMIT guard) via the public soupsieve.compile() and BeautifulSoup .select().

PoC (verified on soupsieve 2.9.2)
import soupsieve as sv
sv.compile('[a' + '\\9'*26 + '=x]')   # ~57 bytes -> ~10s; ~16x time per +4 chars
Novelty

Distinct from the patched GHSA-836r-... (VALUE regex) and GHSA-2wc2-... (comma-list) advisories, which are fixed in 2.9.2; this is a different regex/vector.

Reachability

CSS selectors are usually developer-controlled, so exposure requires an application that compiles UNTRUSTED selector strings (web-scraping-as-a-service, no-code/query builders, user-defined extraction rules). Where selectors are user-supplied, a ~60-byte string hangs the worker.

Note

This issue was fixed in version 3.0.0, which has been yanked from the PyPI registry. Use versions 3.0.2 and above to upgrade.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack

CVE-2026-126193 / GHSA-7g44-g9rc-x53w

More information

Details

Summary

The Soup Sieve CSS selector parser recurses once per level of nested pseudo-class selector (:is(), :not(), :where(), :has()) without any limit on nesting depth. An unauthenticated attacker who can supply a CSS selector string to soupsieve.compile(), soupsieve.select(), or Beautiful Soup's soup.select() / soup.select_one() can force the parser to exceed Python's recursion limit with a small crafted input (about 1.6 KB, roughly 330 nesting levels), raising an uncontrolled RecursionError. Because this exception is not part of the parser's documented error contract, applications that catch only ValueError or SelectorSyntaxError see an unexpected failure of the request or task that parsed the selector.

Root Cause

The parser dispatches each opening pseudo-class token to parse_pseudo_open, which calls back into parse_selectors to parse the pseudo-class body. Every nesting level therefore adds Python stack frames, and no counter, depth guard, or RecursionError handler bounds this descent. The token-count guard SELECTOR_LIMIT = 8192 (added for the earlier comma-separated-list memory issue) counts parsed tokens, not recursion depth; at the failing nesting depth the token count is only about 330, roughly four percent of that limit, so the guard never fires. The security invariant that untrusted selector input must not be able to exhaust interpreter resources is not enforced for nesting depth.

soupsieve/css_parser.py
  CSSParser.parse_pseudo_open (line 985): sel.selectors.append(self.parse_selectors(iselector, index, flags))
  CSSParser.parse_selectors  (line 1137): recursive target; dispatches pseudo-class tokens back into parse_pseudo_class -> parse_pseudo_open
  CSSParser.increment_count  (lines 707-712): SELECTOR_LIMIT token guard; increments once per nesting level, cannot bound depth
Impact

Any application that compiles or evaluates untrusted CSS selectors through Soup Sieve (directly or via Beautiful Soup) is affected. No authentication, privilege, or user interaction is required; the failure occurs during selector parsing, before any document is matched. A single crafted selector of about 1.6 KB reliably raises RecursionError. The demonstrated capability is a transient denial of the individual request, task, or invocation that parsed the malicious selector: the exception propagates uncaught unless the caller handles RecursionError (or a broad except Exception). The RecursionError in CPython 3.x is a recoverable stack unwind, not an interpreter crash or persistent resource exhaustion, and it carries no confidentiality or integrity impact. Applications following the parser's documented error pattern (catching ValueError / SelectorSyntaxError) will not catch it, so a repeated stream of such selectors can plausibly cause repeated per-request failures; this per-request availability effect is the demonstrated consequence, not a service-wide or amplified outage.

Proof of Concept

Requires only an installed Soup Sieve (any release from 0.4 through 2.10) and a default CPython recursion limit of 1000. No Beautiful Soup document or network setup is needed.

import soupsieve as sv

##### ~330 levels of nested :is() around a single tag: about 1.6 KB of input.
depth = 330
selector = ":is(" * depth + "a" + ")" * depth
print("selector length:", len(selector))
sv.compile(selector)
selector length: 1651
Traceback (most recent call last):
  ...
  File ".../soupsieve/css_parser.py", line 985, in parse_pseudo_open
    sel.selectors.append(self.parse_selectors(iselector, index, flags))
RecursionError: maximum recursion depth exceeded

The same failure was reproduced with :not(), :where(), and :has(), and through BeautifulSoup(...).select(selector). A negative control at depth 100 compiles successfully with a token count of 101, confirming the token guard is far from firing.

Attack Chain
  1. Exposure: The application exposes soupsieve.compile() / select() or Beautiful Soup's .select() / .select_one() to attacker-influenced CSS selector input. These are the library's primary public API and ship enabled by default; Soup Sieve is an automatic dependency of Beautiful Soup 4.
  2. Control: The attacker fully controls the selector string. The nested pseudo-class pattern (:is(:is(...a...))) survives tokenization and normalization unchanged.
  3. Path: compile() reaches CSSParser.process_selectors() and then parse_selectors(), which dispatches each pseudo-class token through parse_pseudo_class() into parse_pseudo_open(), which calls parse_selectors() again, once per nesting level.
  4. Guard: The only resource guard is the SELECTOR_LIMIT token counter, which reaches about 330 at the failing depth versus its limit of 8192, so it never fires. No recursion-depth counter and no RecursionError handler exist anywhere in the package.
  5. Primitive: Python's recursion limit is exceeded during parsing, raising an uncontrolled RecursionError.
  6. Result: The unhandled RecursionError propagates to the caller, failing the request, task, or process invocation that parsed the selector, outside the parser's documented ValueError / SelectorSyntaxError error contract.
Bypass Evidence

The relevant existing guard is the SELECTOR_LIMIT = 8192 token counter in increment_count(). It does not block this path: it increments once per nesting level, so at the failing depth of about 330 the count is roughly 330 (about four percent of 8192), verified by instrumenting increment_count and observing a maximum count of 329 at the point RecursionError was raised. A search of the package for RecursionError and RuntimeError handlers returns no matches, so nothing catches the error internally, and functools.lru_cache on the compile path does not cache exceptions. Attempts to invalidate the finding were made and failed: raising the interpreter recursion limit only shifts the required nesting depth (a proportionally larger but still small selector), and a broad except Exception in the caller does catch the error but the parser's documented contract raises only ValueError / SelectorSyntaxError, so callers coded to that contract remain exposed. This is a distinct weakness from the prior comma-separated-list memory-exhaustion advisory: that issue exhausts heap memory through linear object expansion and was addressed by the token count limit, whereas this issue exhausts the call stack through unbounded recursion depth and is not addressed by any released version, including 2.8.4 which was independently confirmed to still raise RecursionError on this input.

Affected Versions
  • Ecosystem: pip (PyPI)
  • Package: soupsieve
  • Confirmed affected range: >= 0.4, <= 2.10
  • Latest release checked: soupsieve 2.10 (PyPI, latest published release as of 2026-09-25)
  • Fix status: not fixed in any released version

The recursive parse_pseudo_open to parse_selectors structure is present in the earliest PyPI release (0.4) and in every subsequent release through the current 2.10, verified against the published PyPI source artifacts. Version 2.5, release 2.8.4 (which added that token-count limit), and 2.10 were each executed and confirmed to raise RecursionError on the crafted input. No released version adds a recursion-depth limit; the token-count SELECTOR_LIMIT introduced in 2.8.4 is architecturally unable to bound nesting depth. There is no registry or tag disagreement and no package or module path change.

Possible Solution

Python's RecursionError is sometimes a contested issue related to security. The Soup Sieve project does not consider it "uncontrolled" and allows it to be raised to indicate Python's maximum recursion depth was reached, and allows it to fail to prevent overflows, a much worse and real security vulnerability. With that said, the algorithm can be reworked to be non-recursive, allowing the selector limit check to now capture and raise an exception. In addition, the limit could be exposed to the user to give them better control.

Mitigation

For those on older versions where the algorithm is still recursive, a try/except block that captures RecursionError can be added around calls if accepting untrusted user input is allowed.

Note

This issue was fixed in version 3.0.0, which has been yanked from the PyPI registry. Use versions 3.0.2 and above to upgrade.

Reported by zx (GitHub: @​manus-pi).

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Soup Sieve: Polynomial-time denial of service in the descendant combinator

CVE-2026-126190 / GHSA-mmhr-3c5m-f64f

More information

Details

Summary

Matching a selector that uses the descendant combinator (a b) takes time that grows polynomially with how deeply the document is nested, and each extra descendant combinator in the selector raises the degree by one. A selector with k descendant combinators takes O(n^(k+1)) time on a chain of n nested elements.

An attacker who controls the HTML or XML that an application passes to Soup Sieve (directly, or through Beautiful Soup's select(), select_one(), css.select(), etc.) can send a very small, deeply nested document that keeps a CPU busy for seconds to minutes against an ordinary selector such as section div div.

Details

To match a b, Soup Sieve checks each element against b and then walks up through its ancestors looking for one that matches a. When the selector has more descendant combinators, the rest of the selector is tried again from each ancestor on that walk, and so on for every combinator. Nothing was reused between walks, so the same ancestors were matched against the same part of the selector over and over.

The worst case is when the leftmost part of the selector never matches, as in section div div against a document of nested <div> with no <section>: every walk goes all the way to the root and no search can stop early.

Timings

Example timings with html.parser on Soup Sieve 3.0.4 and 4.0, using a document of nested <div> (5 bytes each) and no matches:

Nesting depth Input size Selector 3.0.4 4.0
2,000 10 KB section div 1.6 s 0.05 s
4,000 20 KB section div 5.1 s 0.01 s
400 2 KB section div div 6.7 s < 0.01 s
800 4 KB section div div 53.0 s < 0.01 s
100 0.5 KB section div div div 2.5 s < 0.01 s
200 1 KB section div div div 40.9 s < 0.01 s

None of these selectors use unusual syntax.

Proof of concept
import time
import bs4
import soupsieve as sv

soup = bs4.BeautifulSoup('<div>' * 200, 'html.parser')
t = time.process_time()
sv.select('section div div div', soup)
print(time.process_time() - t)

On affected versions, doubling the nesting depth multiplies the time by about 2^(k+1), where k is the number of descendant combinators: about 4x for section div, 8x for section div div, and 16x for section div div div.

Impact

Applications are affected if they run selectors with descendant combinators against documents that untrusted users can influence, such as scrapers, HTML sanitizers or filters, and services that process uploaded or fetched markup. Descendant combinators are among the most common parts of CSS selectors, and a document of about 1 KB is enough to tie up a worker for close to a minute. Applications that only run selectors against trusted documents are not affected.

Patches

Fixed in 4.0 by facelessuser/soupsieve#351. Whether an element is, or has an ancestor that is, a match for part of a selector depends only on its parent, so Soup Sieve now caches that result per element and relation for every element visited on the walk. Each descendant combinator is then linear in the size of the document. Results are unchanged, and ordinary documents are no slower.

Caching is enabled by default, so no changes are needed beyond upgrading. The NOCACHE flag is a temporary fallback for users who run into problems with caching, and it is planned for removal. It uses the old uncached matching, so selectors compiled with NOCACHE are still subject to polynomial time and shouldn't be used with descendant combinators on untrusted input.

Workarounds

If users can't upgrade:

  • Use as few descendant combinators as they can in selectors that run on untrusted documents. Where the structure of the
    document is known, the child combinator (a > b) only looks at the parent and is not affected.
  • Limit the size and nesting depth of untrusted documents before selecting on them.
  • Run selection on untrusted input with a time limit, for example in a worker process that can be stopped.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

facelessuser/soupsieve (soupsieve)

v4.0

Compare Source

4.0

  • BREAK: The contents of an HTML template are no longer treated as part of the document. Selectors do not
    descend into a template, and elements inside one can't see beyond it, which also applies to pseudo-classes such
    as :lang(), :disabled, and :default. select and filter will still reach the contents of a template when
    they are called on the template itself, for example soup.template.select('p'). See the
    FAQ for more information.
  • BREAK: The contents of an iframe are no longer treated as a separate document, as they are not one in a
    browser. Elements in an iframe are normal children, so :root does not match them, and :default,
    :indeterminate, :checked, :dir(), :lang(), and :read-write treat them like any other element. Recent
    versions of html.parser, lxml, and html5lib all escape the contents of an iframe like a browser does, so
    this mostly affects XHTML, Python versions that still don't escape such content in their specific html.parser,
    and elements added to an iframe by hand. :-soup-contains() now also includes the escaped text in an iframe.
    See the FAQ for more information.
  • NEW: Update :disabled and :enabled to treat option and optgroup elements inside a disabled select as
    disabled, following a recent HTML specification update.
  • FIX: Fix the subsequent-sibling combinator and :has(~ ...) never matching top level elements of a fragment
    that has no root element, unless caching was disabled.
  • FIX: :indeterminate now treats a radio button group without a form as extending across the whole document
    instead of the top level element that contains it, and it no longer ignores radio buttons at the top level.
  • FIX: Fix :default to treat a button with a missing or invalid type, and an input with type="image",
    as submit buttons.
  • FIX: Fix :in-range and :out-of-range raising TypeError when the document contains an input without a
    type attribute.
  • FIX: :read-write (and :read-only) now treat contenteditable="plaintext-only" elements as editing hosts and
    match the editable elements inside an editing host, following the nearest contenteditable state.
  • FIX: :read-write (and :read-only) now ignore contenteditable on non-HTML elements, such as an SVG
    foreignObject, as the attribute only applies to HTML elements. Such elements inherit the state of their parent.
  • FIX: :checked now only matches the last radio button with a checked attribute in a radio button group, as
    in a browser, where a group is the radio buttons with the same name and form, including the form attribute.
    :default still matches all of them, and the contents of a template are unaffected as they are not connected.
  • FIX: :dir() and :defined no longer affect the rest of the selector list they are in. Previously, a selector
    list that used either of them could not have its combinators cross an iframe, ignored the specified namespaces,
    and matched nothing in XML, not even the parts that didn't use them. They still do not match in XML, but
    :not(:dir(ltr)) and :not(:defined) now do.
  • FIX: :default and :indeterminate now honor the form attribute, which can associate a submit button or
    radio button with a form it is not in, or leave it without a form. It is ignored in a template, as in the HTML
    specification. Submit buttons outside of a form can now be its default button.
  • FIX: :default, :checked, and :indeterminate now handle a form inside a form like a browser. In HTML, a
    browser ignores the nested form and takes its end tag for that of the parent, which matters for parsers that keep
    the nested form, such as html.parser. In XHTML and in a template, nested forms are real forms.
  • FIX: :checked now matches the option that a browser would select. Without multiple, that is only the
    last option with a selected attribute in a select, and if there are none and the select shows a single
    option, the first option that is not disabled. :default still only considers the selected attribute.
  • FIX: Fix [attribute!=value] excluding values that only start with the specified value, and in XML documents,
    type values that contain a newline.
  • FIX: Match the values of every attribute that the HTML specification lists as ASCII case insensitive (rel,
    method, lang, dir, ...) without ASCII case sensitivity on HTML elements in HTML documents, not just type.
    Non-HTML elements are matched case sensitively.
  • FIX: :dir() now matches non-HTML elements, such as SVG and MathML, by the direction they inherit from their
    parent (the dir attribute only applies to HTML elements), and HTML elements inside them, such as in an SVG
    foreignObject, by the direction of their ancestors.
  • FIX: Fix :dir() ignoring the value of an input with dir="auto" and a missing or empty type.
  • FIX: :dir() now uses a table generated from Unicode 18 instead of unicodedata, so results no longer depend
    on the Unicode version of the Python in use, and unassigned code points use their default direction.
  • FIX: :dir() now uses the value of an input with dir="auto" when type is hidden, password, submit,
    reset, or button, as the HTML specification does.
  • FIX: dir="auto" and bdi now analyze the text of non-HTML elements, such as SVG and MathML, and only ignore
    HTML elements such as script, style, and bdi. The text directly in an iframe is analyzed as well, and the
    contents of a template, which are not part of the document, are not.
  • FIX: :dir() no longer lets the contents of a template inherit direction from the template or its
    ancestors, as they are not part of the document. They are left to right unless they specify otherwise.
  • FIX: :dir() now matches a bdi element that is the root by its text instead of assuming left to right.
  • FIX: :dir() now treats any element without a parent element as left to right, not just the root. Before,
    all but the first top level element of a fragment parsed with html.parser never matched.
  • FIX: :dir() now accepts any identifier, as CSS requires, including escaped ones. Values other than ltr and
    rtl do not match anything.
  • FIX: Respect namespaces provided by the parser when the root is not an HTML element, such as an svg element
    extracted from an html5lib document. Previously every element in such a tree was treated as an HTML element,
    which affected namespace selectors, namespaced attributes, and HTML specific pseudo-classes.
  • FIX: Fix :lang() treating an element with an empty lang or xml:lang attribute as having the language of
    a tagged ancestor.
  • FIX: Cache forms without a default button when matching :default to avoid quadratic time on forms with
    many non-default submit candidates.
  • FIX: Fix :in-range and :out-of-range matching elements whose value, min, or max has a trailing newline;
    per HTML, such values are not valid, so they are treated like a missing value and cannot be out of range.
  • FIX: Fix :in-range and :out-of-range raising ValueError when a date, month, week, or local date and
    time input has a year with more digits than Python will convert; such a year is now treated as invalid.
  • FIX: Fix :in-range and :out-of-range not recognizing a datetime-local value, min, or max that uses a
    single space instead of T to separate the date and time.
  • FIX: Search a form only once for checked radio buttons when matching :indeterminate to avoid quadratic time
    on forms with many radio button groups.
  • FIX: :lang() now uses the lang attribute of SVG elements, as the HTML specification does (with xml:lang
    taking precedence). Previously only xml:lang was considered for elements outside the HTML namespace.
  • FIX: :defined no longer matches HTML elements with an is attribute (customized built-in elements), which,
    like custom elements, are undefined until they are registered.
  • FIX: Cache the index of each child when matching the general sibling combinator (a ~ b and :has(~ b)) to
    avoid quadratic time when the first matching sibling is far into a long list of siblings.
  • FIX: Match attribute values with the i modifier using ASCII case insensitivity.
  • FIX: Treat an input with an unknown type, such as type="foo", as a text input in :placeholder-shown,
    :read-write, :read-only and :dir(), as an invalid type is in the Text state in the HTML specification.
  • FIX: Fix :enabled and :disabled never matching input elements with type="hidden".
  • FIX: :required no longer matches input elements of types the required attribute does not apply to
    (hidden, range, color, submit, image, reset and button). Like in browsers, they match :optional.
  • FIX: Cache whether an element is or has a matching ancestor when matching the descendant combinator (a b) to
    avoid time that grows with the depth of the document to the power of the number of combinators.

v3.0.4

Compare Source

3.0.4

  • FIX: Keep own and descendant text separate when combining :-soup-contains() and :-soup-contains-own().
  • FIX: Cache resolved directionality when matching :dir() to avoid quadratic time on deeply nested
    dir="auto" elements.
  • FIX: Fix auto handling in regard to :dir() selector. When an element with dir="auto" (or a <bdi>)
    contains no strong direction characters, it should be assumed as left-to-right and not assume the direction of the
    parent.
  • FIX: Match numeric input ranges correctly when values or bounds use scientific notation.
  • FIX: Fix :in-range and :out-of-range raising ValueError for week inputs whose week-year is 10000 or
    greater.
  • FIX: Fix :nth-last-child(an+b of S) matching the wrong elements when the first sibling tested does not
    match S.
  • FIX: escape() now only leaves non-ASCII identifier code points unescaped, as defined by the CSS specification.
    All other non-ASCII characters are escaped.
  • FIX: Allow unescaped U+0080 - U+009F characters in identifiers to match browser behavior.
  • FIX: Fix :in-range and :out-of-range treating time and datetime-local values with seconds as
    invalid.

v3.0.3

Compare Source

3.0.3

  • FIX: When matching with >, the `BeautifulS

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner November 13, 2026 20:45
@renovate renovate Bot added security Addresses a security advisory, CVE, or hardens security posture skip:codecov Skip Codecov reporting and check labels Nov 13, 2026
@sonarqubecloud

sonarqubecloud Bot commented Nov 13, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security Addresses a security advisory, CVE, or hardens security posture skip:codecov Skip Codecov reporting and check

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants