eml_parser: URL extraction bypass via HTML entities in URLs
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the clean_found_uri function in eml_parser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. Valid encoded URLs and their host names are therefore rejected and omitted from the extracted URL and domain lists. Email security gateways and SOC pipelines that use those lists as indicators of compromise may fail to submit the hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection. This issue is fixed in version 3.0.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GOVCERT-LU | eml_parser | before 3.0.2 | 3.0.2 | Patch available | CNA |
| — | eml_parser (PyPI) | before 3.0.2 | 3.0.2 | Patch available | GHSA-fxgq-9m89-cxj9 |
- eml_parser VendorGOVCERT-LU Affected before 3.0.2 Fixed in 3.0.2 Patch available CNA
- eml_parser (PyPI) Vendor— Affected before 3.0.2 Fixed in 3.0.2 Patch available GHSA-fxgq-9m89-cxj9
Remediation
- Fix · CNA eml_parser (GOVCERT-LU) Fixed in 3.0.2
- Fix · GHSA-fxgq-9m89-cxj9 eml_parser (PyPI) Fixed in 3.0.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55618
- 2026-10-03 Alias added: GHSA-fxgq-9m89-cxj9
References
Other 5
- https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-fxgq-9m89-cxj9
- https://github.com/GOVCERT-LU/eml_parser/pull/90
- https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
- https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2
- https://github.com/GOVCERT-LU/eml_parser
More GOVCERT-LU vulnerabilities
- TI-2026-32722 eml_parser: Recursion DoS via nested message/rfc822 attachments CVSS 4.0MEDIUM 6.3
- TI-2026-23366 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write CVSS 3.1MEDIUM 5.5
- TI-2026-40149 eml_parser: DoS via deeply nested parens in Received headers CVSS 3.1HIGH 7.5
- TI-2026-40148 eml_parser: Parser DoS via deeply nested parentheses in e-mail headers CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-55618 · CVE Program
- CVE-2026-55618 · NVD
- FIRST EPSS
- GHSA-fxgq-9m89-cxj9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-55618 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences