ETK-2026-1290Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1290",
  "cve_id": null,
  "display_id": "ETK-2026-1290",
  "ghsa_id": "GHSA-c676-3pcq-7gcj",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Uncontrolled recursion in turbohtml XSLT transforms",
  "summary": "turbohtml versions before 1.14.0 can exhaust the native call stack while transforming deeply nested XML or HTML with XSLT. An attacker may crash the hosting process by supplying an excessively nested document when the application transforms untrusted input.",
  "mitigation": "Upgrade turbohtml to version 1.14.0 or later. Until upgrades are complete, reject or constrain deeply nested untrusted documents before XSLT processing.",
  "vendor": "pip",
  "product": "pip:turbohtml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.1.0, <= 1.13.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.14.0"
      ],
      "package_name": "turbohtml",
      "purl": "pkg:pypi/turbohtml"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.4674581,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T21:12:30+00:00",
      "days": -11.35785996550926,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:49.122951+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-c676-3pcq-7gcj"
    }
  }
}