Threats affecting pkg:brew/bandcamp-dl

CVE-2026-126192 describes a performance issue in Soup Sieve when using a CSS selector with a general sibling combinator inside :has(), such as div:has(a ~ b). This selector runs in quadratic time relative to the number of sibling elements when evaluated against untrusted HTML, potentially causing significant CPU delays. The issue arises because the implementation cannot short-circuit when the right-hand sibling element is absent, leading to nested scans over siblings. This can stall applications processing attacker-controlled HTML. The vulnerability affects Soup Sieve versions starting from 0.0.12. The vendor notes that this quadratic behavior is expected given the selector semantics and recommends careful use of :has() with constrained selectors to mitigate impact.

CVE-2026-126190 is a denial of service vulnerability in Soup Sieve's handling of CSS selectors with descendant combinators. The matching algorithm has polynomial time complexity relative to the document's nesting depth and the number of descendant combinators, allowing an attacker controlling input HTML or XML to cause excessive CPU usage by submitting deeply nested documents. This affects applications that run selectors on untrusted markup. The issue is fixed in Soup Sieve version 4.0 by introducing caching to reduce complexity to linear time.