Technical impact
Soup Sieve’s CSS selector parser contains a catastrophic backtracking flaw in a regular expression used for attribute selectors with unterminated quoted values. When an attacker supplies a specially crafted CSS selector to soupsieve.compile() or to BeautifulSoup’s .select() / .select_one() methods, the parser consumes excessive CPU cycles, leading to total service denial. The weakness is an example of a regular expression denial‑of‑service vulnerability and falls under CWE‑1333 and CWE‑400.
Affected Systems
The vulnerability affects the soupsieve library developed by facelessuser for all releases older than 2.8.4. Any application that imports soupsieve directly or indirectly through BeautifulSoup and accepts untrusted CSS selector strings is at risk. Updating to soupsieve 2.8.4 or newer removes the flaw, so only legacy deployments remain vulnerable.
Risk and Exploitability
The CVSS score of 7.5 classifies this as high severity. The EPSS score of less than 1% suggests that real‑world exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote—an adversary can supply malformed selector strings via network connections or user input that reaches the library. Successful exploitation would exhaust CPU resources on the host, disrupting availability.
Github GHSA