Threats affecting pkg:brew/manim

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The regex uses adjacent quantified groups over overlapping character classes, causing quadratic backtracking on failing matches. This can be exploited by an attacker supplying a crafted CSS selector string, causing the parser to stall for seconds or minutes depending on input size. The vulnerability affects applications using user-controlled selectors with soupsieve or BeautifulSoup's select methods. Fixed in soupsieve version 0.20.1_1.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END. This regex is used to trim trailing whitespace/comments from CSS selectors but is implemented with a pattern that causes quadratic time complexity (O(n²)) when processing long runs of whitespace or comments not exactly at the end of the string. This can cause significant CPU delays when compiling valid CSS selectors containing large whitespace gaps. The issue affects soupsieve versions prior to 0.20.1_1 and is exploitable when user-controlled selectors are passed to soupsieve or BeautifulSoup's selector APIs.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers from catastrophic backtracking when processing attribute selectors with unterminated quoted values. This flaw allows an attacker to cause CPU exhaustion by supplying a crafted CSS selector string, leading to thread blocking and significant processing delays. The vulnerability affects soupsieve versions from 0.19.0 up to but not including 0.20.1_1 and has been assigned CVE-2026-49477. A fix is available in version 0.20.1_1.

A memory exhaustion vulnerability exists in soupsieve, the CSS selector engine used by Beautiful Soup 4, due to unbounded memory allocation when parsing large comma-separated selector lists. An attacker can supply a crafted CSS selector string with many comma-separated items, causing the parser to allocate excessive heap memory and potentially crash or degrade the application. This affects applications that use soupsieve.compile() or Beautiful Soup's .select()/.select_one() methods with user-supplied selectors. The issue is fixed in soupsieve version 0.20.1_1.