ETK-2026-303Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-303",
  "cve_id": null,
  "display_id": "ETK-2026-303",
  "ghsa_id": "GHSA-m33r-492v-5wx8",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Stack exhaustion in turbohtml CSS minification",
  "summary": "turbohtml versions before 1.13.1 can consume the process stack while minifying excessively nested CSS. An attacker able to supply CSS, or HTML containing style content when CSS minification is enabled, may cause the application process to stop.",
  "mitigation": "Upgrade turbohtml to version 1.13.1 or later. Until upgraded, do not run CSS minification on untrusted CSS or HTML.",
  "vendor": "pip",
  "product": "pip:turbohtml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.1.0, <= 1.13.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.13.1"
      ],
      "package_name": "turbohtml",
      "purl": "pkg:pypi/turbohtml"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 14.757767233333333,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-02T05:51:57.954172+00:00",
      "days": -19.08861070346065,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T07:59:33.941537+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-01T05:52:28+00:00",
      "days": -20.088262950821758,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T07:59:33.941537+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-m33r-492v-5wx8"
    },
    "trigger_signal": {
      "at": "2026-10-01T05:52:28+00:00",
      "days": -20.088262950821758,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T07:59:33.941537+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-m33r-492v-5wx8"
    }
  }
}