Is CVE-2026-126192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126192 being exploited in the wild.

How severe is CVE-2026-126192?

Medium severity, published 12 November 2026.

Which products and versions are affected?

Facelessuser Soup Sieve before 2.10; soupsieve (PyPI) <= 2.9.2.

Is there a fix for CVE-2026-126192?

Yes: fixed in 2.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126192 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126192?

Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126192: Soup Sieve ReDoS via general sibling combinator in :has()

Q: Is there a fix for CVE-2026-126192?

Yes: fixed in 2.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126192 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126192?

Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126192 · Severity: medium · Published 2026-11-12

Soup Sieve is a CSS selector library used with Beautiful Soup 4 for parsing HTML documents. When applications process untrusted HTML with certain developer-authored selectors containing the general sibling combinator inside :has(), the library performs excessive repetitive scanning, causing a single worker thread to hang for minutes on even small documents. This can lead to denial of service attacks against web scraping applications or HTML processing services.

Technologies: Facelessuser Soup Sieve, soupsieve (PyPI). Vendors: Facelessuser, PyPI.

Quick answers

Is CVE-2026-126192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126192 being exploited in the wild.
How severe is CVE-2026-126192?: Medium severity, published 12 November 2026.
Which products and versions are affected?: Facelessuser Soup Sieve before 2.10; soupsieve (PyPI) <= 2.9.2.
Is there a fix for CVE-2026-126192?: Yes: fixed in 2.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126192 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126192?: Check whether you run Facelessuser Soup Sieve or soupsieve (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.10

Technical details

The vulnerability is a ReDoS (Regular Expression Denial of Service) equivalent in CSS selector matching: selectors like div:has(a ~ b) with an absent right-hand side trigger quadratic-time scanning of candidate elements' following siblings. The flaw affects the general sibling combinator (~) when used inside :has() pseudo-class matching in Soup Sieve versions prior to 2.10; the adjacent sibling form (+) and trusted-only document processing are not vulnerable in the same way. The fix implements caching to eliminate the redundant scans.

Affected products

facelessuser Soup Sieve before 2.10

Identifiers

CVE-2026-126192
GHSA-4j63-6c4x-wfg4

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.