KROMSE explanation

facelessuser soupsieve has a serious security flaw (CVE-2026-126191, CVSS 7.5). The official record says: Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector.

Not confirmed yet, but attack code is public, so attacks often follow within days.

Anyone running facelessuser soupsieve older than 3.0.2.

• Update facelessuser soupsieve to 3.0.2 or later.
• Not sure if you use it? KROMSE can check your product for free.