AIKIDO-2026-11059

TL;DR

Affected versions of this package are vulnerable to regular expression denial of service in the CSS selector parser. The VALUE regex pattern used to match quoted attribute values in css_parser.py lacks proper termination guards and falls into exponential backtracking when given an unterminated quoted attribute selector such as [a="xxxx. An attacker who can influence the selector string passed to soupsieve.compile() or Beautiful Soup's .select() can hang the parser for several seconds with only a few hundred bytes of input, and CPU consumption grows exponentially per added character. The fix tightens the attribute-value regex so unterminated input no longer triggers exponential backtracking.