ETK-2026-3583Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3583",
  "cve_id": null,
  "display_id": "ETK-2026-3583",
  "ghsa_id": "GHSA-r6hg-5xv5-jgr7",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "XPath compiler stack exhaustion in turbohtml",
  "summary": "turbohtml through version 1.15.6 can crash when an application processes untrusted XPath queries or XSLT stylesheet expressions. An attacker can submit an oversized operator sequence in an XPath predicate to terminate the Python process during expression compilation, causing a denial of service; attacker-controlled expression text is required.",
  "mitigation": "Upgrade turbohtml to version 1.15.7 or later. Until upgrades are complete, reject or strictly limit the size of untrusted XPath expressions and XSLT attribute values before passing them to turbohtml.",
  "vendor": "pip",
  "product": "pip:turbohtml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.15.6"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.15.7"
      ],
      "package_name": "turbohtml",
      "purl": "pkg:pypi/turbohtml"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.29103345,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-05T04:41:41+00:00",
      "days": -0.6301808636805556,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T19:49:08.665681+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-r6hg-5xv5-jgr7"
    },
    "trigger_signal": {
      "at": "2026-11-05T04:41:41+00:00",
      "days": -0.6301808636805556,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T19:49:08.665681+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-r6hg-5xv5-jgr7"
    }
  }
}