Vulnerability GHSA-6655-6qjp-jx7x

High Risk

2 hours ago

Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

0.4 and 0.5 and 0.5.1 - 0.5.3 and 0.6 and 1.0b1 and 1.0b2 and 1.0 and 1.0.1 - 1.0.2 and 1.1 and 1.2 and 1.2.1 and 1.3 and 1.3.1 and 1.4 and 1.5 and 1.6 and 1.6.1 - 1.6.2 and 1.7 and 1.7.1 - 1.7.3 and 1.8 and 1.9 and 1.9.1 - 1.9.6 and 2.0 and 2.0.1 and 2.1 and 2.2 and 2.2.1 and 2.3 and 2.3.1 - 2.3.2 and 2.3.2.post1 and 2.4 and 2.4.1 and 2.5 and 2.6 and 2.7 and 2.8 and 2.8.1 - 2.8.4 and 2.9 and 2.9.1 - 2.9.2 and 2.10 and 3.0 and 3.0.1

Summary

Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

Details

Summary

The IDENTIFIER/CSS_ESCAPES regex (css_parser.py:119-124) exhibits exponential backtracking on a run of ambiguous digit-escapes (\9) in an attribute-name or tag position of an otherwise well-formed selector. It fires at compile time (before the SELECTOR_LIMIT guard) via the public soupsieve.compile() and BeautifulSoup .select().

PoC (verified on soupsieve 2.9.2)

import soupsieve as sv
sv.compile('[a' + '\\9'*26 + '=x]')   # ~57 bytes -> ~10s; ~16x time per +4 chars

Novelty

Distinct from the patched GHSA-836r-... (VALUE regex) and GHSA-2wc2-... (comma-list) advisories, which are fixed in 2.9.2; this is a different regex/vector.

Reachability

CSS selectors are usually developer-controlled, so exposure requires an application that compiles UNTRUSTED selector strings (web-scraping-as-a-service, no-code/query builders, user-defined extraction rules). Where selectors are user-supplied, a ~60-byte string hangs the worker.