CVE-2026-55618: CVE-2026-55618: URL Extraction Bypass via HTML Entities in eml_parser

#security #cve #cybersecurity

CVE-2026-55618: URL Extraction Bypass via HTML Entities in eml_parser

Vulnerability ID: CVE-2026-55618
CVSS Score: 6.5
Published: 2026-08-25

A critical logical flaw in the eml_parser Python module prior to version 3.0.2 allows malicious URLs to evade automated security analysis pipelines. By encoding key URI delimiter characters as HTML decimal entities, an attacker can mask indicators of compromise. Security controls, orchestration layers, and sandbox systems fail to detect these links, while downstream Mail User Agents natively reconstruct the malicious hyper-references when processed by end-users. This mechanism undermines the integrity of automated indicator extraction processes within Security Operations Centers.

TL;DR

A structural logic flaw in eml_parser's validation flow allows attackers to obfuscate malicious URLs using HTML entities. The module validates candidate strings before decoding them, causing the extraction engine to discard the obfuscated links. This lets phishing and malware campaigns evade security automated tooling while remaining fully functional in the victim's email client.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-116
Attack Vector: Network (AV:N)
CVSS Score: 6.5
EPSS Score: Not registered
Impact: High Integrity Loss (Bypass of security analysis pipelines)
Exploit Status: Proof of Concept (PoC)
KEV Status: Not Listed

Affected Systems

GOVCERT-LU eml_parser before 3.0.2
Security gateways and SOAR platforms utilizing vulnerable versions of eml_parser
eml_parser: < 3.0.2 (Fixed in: 3.0.2)

Code Analysis

Commit: 746a69f

Fix URL validation flow by unescaping HTML entities before executing length and structural checks, and perform recursive domain parsing from extracted URLs.

Exploit Details

GitHub: Official unit tests verifying the extraction of URLs and domains embedded with HTML decimal entities.

Mitigation Strategies

Upgrade to eml_parser version 3.0.2 or higher to permanently resolve the logic bug.
Pre-process and unescape HTML content within custom ingestion pipelines prior to calling eml_parser.
Implement defense-in-depth checking by correlating extracted URI lists with downstream proxy and DNS telemetry.

Remediation Steps:

Execute the command 'pip install --upgrade eml_parser>=3.0.2' to update the python library in your deployment environments.
Review custom ingestion scripts and verify that any fallback string normalization filters are properly integrated.
Run the provided test suite on sample .eml files containing entity-encoded strings to verify that the extraction engine detects all targets.

References

Read the full report for CVE-2026-55618 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community