Is CVE-2026-126189 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126189 being exploited in the wild.

How severe is CVE-2026-126189?

Medium severity, with a CVSS score of 5.3, published 12 November 2026.

Which products and versions are affected?

Facelessuser Soup Sieve before 4.0.1.

Is there a fix for CVE-2026-126189?

Yes: fixed in 4.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126189 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126189?

Check whether you run Facelessuser Soup Sieve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126189: Soup Sieve quadratic ReDoS in CSS selector matching

CVE-2026-126189 · Severity: medium · CVSS 5.3 · Published 2026-11-12

Soup Sieve is a CSS selector library used with Beautiful Soup 4 to parse and search HTML/XML documents. Versions before 4.0.1 suffer from algorithmic inefficiency when processing deeply nested or wide HTML, where the :has() selector causes repeated tree searches. An attacker can craft malicious HTML that occupies a worker thread for seconds or minutes, causing a denial of service against applications that process untrusted documents.

Technologies: Facelessuser Soup Sieve. Vendors: Facelessuser.

Quick answers

Is CVE-2026-126189 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126189 being exploited in the wild.
How severe is CVE-2026-126189?: Medium severity, with a CVSS score of 5.3, published 12 November 2026.
Which products and versions are affected?: Facelessuser Soup Sieve before 4.0.1.
Is there a fix for CVE-2026-126189?: Yes: fixed in 4.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126189 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126189?: Check whether you run Facelessuser Soup Sieve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.1

Technical details

The vulnerability is a quadratic time complexity issue in :has() pseudo-class matching, where descendant subtrees are repeatedly searched for each candidate and parent elements containing :has(> ...) are reevaluated for each child. Attack vectors include network input of untrusted HTML/XML documents to applications using select(), select_one(), or Beautiful Soup CSS APIs. The fix implements caching of descendant match results to avoid redundant evaluations; selectors compiled with NOCACHE retain the vulnerable uncached behavior.

Affected products

facelessuser Soup Sieve before 4.0.1

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.