Is CVE-2026-126191 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126191 being exploited in the wild.

How severe is CVE-2026-126191?

High severity, with a CVSS score of 7.5, published 12 November 2026.

Which products and versions are affected?

Facelessuser Soup Sieve prior to 3.0.

Is there a fix for CVE-2026-126191?

Yes: fixed in 3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126191 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126191?

Check whether you run Facelessuser Soup Sieve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126191: Soup Sieve CSS selector ReDoS via exponential backtracking

CVE-2026-126191 · Severity: high · CVSS 7.5 · Published 2026-11-12

Soup Sieve is a CSS selector library used by Beautiful Soup 4 to parse HTML and XML documents. Prior to version 3.0, a malicious or malformed CSS selector can cause the selector compiler to consume excessive CPU and stall indefinitely due to exponential regular-expression backtracking. An application that accepts untrusted selector input can be subject to denial of service attacks with minimal input.

Technologies: Facelessuser Soup Sieve. Vendors: Facelessuser.

Quick answers

Is CVE-2026-126191 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126191 being exploited in the wild.
How severe is CVE-2026-126191?: High severity, with a CVSS score of 7.5, published 12 November 2026.
Which products and versions are affected?: Facelessuser Soup Sieve prior to 3.0.
Is there a fix for CVE-2026-126191?: Yes: fixed in 3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126191 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126191?: Check whether you run Facelessuser Soup Sieve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0

Technical details

The vulnerability is a regular-expression denial of service (ReDoS) in the CSS_ESCAPES and IDENTIFIER regex subpatterns used during selector compilation. Attackers can craft selectors with ambiguous digit escapes in attribute-name or tag positions that trigger exponential backtracking. The flaw occurs in soupsieve.compile() or Beautiful Soup's select() method before the SELECTOR_LIMIT check is applied, allowing short inputs to cause a denial of service.

Affected products

facelessuser Soup Sieve prior to 3.0

Timeline

2026-11-12: disclosed
2026-10-05: patched: Fix merged in PR #300 to reduce regex backtracking using atomic groups and possessive quantifiers

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.