Threats tagged 'ghsa-6655-6qjp-jx7x'

Soup Sieve versions prior to 3.0.2 contain a regular expression vulnerability in the IDENTIFIER/CSS_ESCAPES regex used during selector compilation. This flaw causes exponential backtracking on a sequence of ambiguous digit-escapes (\9) in CSS selectors, leading to denial of service by hanging the process at compile time. The issue affects the public soupsieve.compile() function and BeautifulSoup's .select() method when processing untrusted selector strings. The vulnerability is fixed in version 3.0.2 and later.