GHSA-fxgq-9m89-cxj9: Medium severity pip/eml_parser vulnerability
Summary
emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML entities for the :, /, or . characters. These URLs would then not be included in the list of extracted URLs. Similarly, the host parts of such URLs would not be extracted.
For example, neither the URL https://phishing.example.com nor its host (phishing.example.com) would appear in the parsing result.
Impact
emlparser is used in email security gateways and SOC pipelines to extract URLs as IOCs. Those URLs are then checked against threat-intel feeds, URL reputation services, and sandboxes. A URL that is not extracted is never checked.
Patches
Since version 3.0.2 the library unescapes all HTML entities in every URL before deciding to accept or reject it. A test was added to prevent regressions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/eml_parserto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
eml_parserto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Email security gateways and SOC pipelines that use eml_parser to extract URLs as indicators of compromise are exposed. The practical impact is that entity-encoded malicious URLs may not be sent to threat-intelligence, reputation, or sandbox checks.
What does an attacker need to do to evade URL extraction?
An attacker needs to use HTML entities for characters such as colon, slash, or dot in a URL. For example, a URL encoded with entities for :// and . can be valid after unescaping but be rejected before extraction in affected versions.
Are default URL-validation behaviors affected?
Yes. In versions before 3.0.2, validation occurred before HTML entities were unescaped, causing otherwise valid entity-encoded URLs and their hostnames to be omitted from parsing results.
What should teams do if they cannot immediately upgrade?
Ensure downstream email analysis or IOC-extraction processing unescapes HTML entities before validating and extracting URLs. This is needed so entity-encoded URLs are available for reputation and threat-intelligence checks.
How can I determine whether messages were affected?
Review parsing results for emails containing URLs with HTML entities representing :, /, or . characters. If the decoded URL or hostname is absent from extracted URL results, the pipeline was affected.