{"id":"GHSA-4j63-6c4x-wfg4","summary":"Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time","details":"## Summary\n\nMatching a selector that puts a general-sibling combinator inside `:has()`, such as `div:has(a ~ b)`, against untrusted HTML runs in O(n²) time in the number of sibling elements. A single small document with a few thousand siblings ties the process up for a minute of CPU, so an application that runs a fixed selector of this shape over HTML it doesn't control can be stalled by one request.\n\n`:has` is powerful, but much in the same way poor regular expressions can be crafted to cause catastrophic backtracking with greedy capturing, has can be used to create non-ideal scenarios that can cause large portions of the tree to be evaluated for one or many elements if not used thoughtfully.\n\nThis behavior is not exclusive to Soup Sieve, but browsers make note of these potential performance issues themselves: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/:has#performance_considerations.\n\nWith all of that said, there is room for improvements that can in some cases greatly improve performance.\n\n## Details\n\n`:has(a ~ b)` asks \"does this element contain an `a` that has a later sibling `b`?\". When no `b` is present, soupsieve can't short-circuit, and it answers the question with a nested scan: `match_future_child` walks every candidate `a` under the scope, and for each one the general-sibling branch of `match_future_relations` walks all of that `a`'s following siblings looking for `b`. With n siblings that is (n-1) + (n-2) + ... + 1 comparisons, i.e. O(n²).\n\nThe adjacent-sibling form `div:has(a + b)` stays linear, because its branch checks only the one immediately following sibling per candidate. So the cost is specific to the general-sibling `~` (and `~` nested inside `:has`), and it shows up on the common case where the right-hand side simply isn't there.\n\n## Proof of concept\n\nInstalled from PyPI: `pip install soupsieve==2.9.2 beautifulsoup4`.\n\n```python\nimport time\nimport soupsieve\nfrom bs4 import BeautifulSoup\n\nselector = \"div:has(a ~ b)\"\n\nfor n in (1000, 2000, 4000, 8000):\n    html = \"\u003cdiv\u003e\" + (\"\u003ca\u003e\u003c/a\u003e\" * n) + \"\u003c/div\u003e\"\n    soup = BeautifulSoup(html, \"html.parser\")\n    start = time.perf_counter()\n    soupsieve.select(selector, soup)\n    print(n, round((time.perf_counter() - start) * 1000), \"ms\")\n```\n\nMeasured:\n\n```\nn=1000    837 ms\nn=2000   3667 ms\nn=4000  14797 ms\nn=8000  59746 ms\n```\n\nTime quadruples for each doubling of n. The n=8000 input is a ~56 KB HTML fragment.\n\n## Impact\n\nAvailability. Any caller that evaluates a fixed selector containing a general sibling under `:has()` over attacker-controlled markup can be forced to spend minutes of CPU on a small input. The selector is developer-authored and ordinary; the untrusted part is the HTML, which is soupsieve's normal input.\n\nA single-pass evaluation of the sibling run (remember whether an `a` has been seen while scanning the siblings once) would make this case linear.\n\n## Mitigation\n\nQuadratic time for `:has` in some circumstances is expected and not a bug. While we've made optimizations and there may be more in the future, the way `:has` is designed to operate will never perform in linear time in all circumstances. Users should thoughtfully apply the use of `:has`.\n\nThe anchor selector (the `A` in `A:has(B)`) should not be an element that has too many children. Additionally, too general an anchor, such as `*`, can cause `:has()` to be applied to every element.\n\nFurther, it is recommended that the inner selector (the `B` in `A:has(B)`) should use combinators like `\u003e` or `+` to limit traversal. When the selector inside `:has()` is not tightly constrained, Soup Sieve might need to traverse the entire subtree of the anchor\nelement to check the condition.\n\nIf the risk for a given project is too great, user input can be scanned for usage of `:has` and be denied. Calls can also be wrapped in a timeout to prevent long-running processes as well.","aliases":["CVE-2026-126192"],"modified":"2026-11-13T01:00:06.040402597Z","published":"2026-11-13T00:45:18Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-11-13T00:45:18Z","nvd_published_at":"2026-11-12T17:17:32Z","cwe_ids":["CWE-400","CWE-407"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126192"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/pull/304"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.10"}],"affected":[{"package":{"name":"soupsieve","ecosystem":"PyPI","purl":"pkg:pypi/soupsieve"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0"}]}],"versions":["0.4","0.5","0.5.1","0.5.2","0.5.3","0.6","1.0","1.0.1","1.0.2","1.0b1","1.0b2","1.1","1.2","1.2.1","1.3","1.3.1","1.4","1.5","1.6","1.6.1","1.6.2","1.7","1.7.1","1.7.2","1.7.3","1.8","1.9","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","2.0","2.0.1","2.1","2.2","2.2.1","2.3","2.3.1","2.3.2","2.3.2.post1","2.4","2.4.1","2.5","2.6","2.7","2.8","2.8.1","2.8.2","2.8.3","2.8.4","2.9","2.9.1","2.9.2"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.9.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-4j63-6c4x-wfg4/GHSA-4j63-6c4x-wfg4.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}