CVE-2026-55618: eml_parser: URL extraction bypass via HTML entities in URLs
Summary
emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML entities for the :, /, or . characters. These URLs would then not be included in the list of extracted URLs. Similarly, the host parts of such URLs would not be extracted.
For example, neither the URL https://phishing.example.com nor its host (phishing.example.com) would appear in the parsing result.
Impact
emlparser is used in email security gateways and SOC pipelines to extract URLs as IOCs. Those URLs are then checked against threat-intel feeds, URL reputation services, and sandboxes. A URL that is not extracted is never checked.
Patches
Since version 3.0.2 the library unescapes all HTML entities in every URL before deciding to accept or reject it. A test was added to prevent regressions.
Other sources
emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. Valid encoded URLs and their host names are therefore rejected and omitted from the extracted URL and domain lists. Email security gateways and SOC pipelines that use those lists as indicators of compromise may fail to submit the hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection. This issue is fixed in version 3.0.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/eml_parserto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
eml_parserto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using eml_parser to extract URLs or hosts from email for security analysis are exposed if they run a version earlier than 3.0.2. This is particularly relevant to email security gateways and SOC pipelines that send extracted indicators to reputation, threat-intelligence, or sandboxing systems.
What does an attacker need to do to evade extraction?
An attacker needs to place a URL in an email using HTML entities for characters such as the colon, slash, or period. For example, encoding URL separators and dots can cause the URL and its host not to appear in the parsing result.
Are default URL-extraction workflows affected?
Any workflow that relies on eml_parser's extracted URL or host lists is affected when processing these entity-encoded URLs in versions before 3.0.2. The missed URL is not passed to downstream checks because it is rejected before HTML entities are unescaped.
What is the remediation?
Upgrade eml_parser to version 3.0.2 or later. This version unescapes HTML entities in every URL before determining whether the URL should be accepted.