CVE-2026-55618: eml_parser Information Disclosure Flaw

CVE-2026-55618 Overview

CVE-2026-55618 affects eml_parser, a Python module used to parse .eml files and extract indicators such as URLs, domains, and email addresses. Versions prior to 3.0.2 contain an order-of-operations flaw in the clean_found_uri function within eml_parser/parser.py. The function validates candidate URL strings before HTML entities encoding colons, slashes, or periods are unescaped. Valid but HTML-encoded URLs are therefore silently discarded from the extracted URL and domain lists. Email security gateways and SOC pipelines relying on these outputs as indicators of compromise may fail to forward hidden links to threat intelligence feeds, reputation services, or sandboxes. The maintainers fixed the issue in version 3.0.2.

Critical Impact
Malicious URLs hidden using HTML entity encoding evade extraction, letting phishing and malware links bypass downstream inspection performed by email security gateways and SOC automation.

Affected Products

eml_parser Python module versions prior to 3.0.2
Email security gateways that consume eml_parser output as IOCs
SOC ingestion pipelines and phishing triage automation built on eml_parser

Discovery Timeline

2026-08-25 - CVE-2026-55618 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55618

Vulnerability Analysis

The flaw is an output-neutralization defect [CWE-116] in the URL extraction pipeline of eml_parser. When the parser encounters a candidate URL inside HTML email content, clean_found_uri first applies validation against expected URL syntax and only afterward unescapes HTML entities that may represent structural characters such as : (:), / (/), and . (.). Because validation runs against the pre-decoded string, a URL that would be perfectly valid after decoding fails the check and is dropped from the returned list.

The practical consequence is a detection gap rather than direct code execution. Phishing operators can craft email bodies that render clickable, working URLs in a mail client while ensuring the same URLs never appear in the extracted indicator set. Downstream consumers, including email security gateways and SOC playbooks that submit extracted URLs to reputation services and sandboxes, will not see the hidden links and therefore will not block them.

Root Cause

The root cause is incorrect ordering of transformation and validation. clean_found_uri should decode HTML entities to their canonical characters before performing URL and host-name validation. Reversing this order causes encoded but semantically valid URLs to be classified as invalid and excluded from the parser's output.

Attack Vector

Exploitation requires an attacker to send a crafted email through infrastructure that uses eml_parser for IOC extraction. The attacker embeds URLs in HTML message bodies using HTML numeric or named entities for the scheme delimiter, path separator, or dot characters of the hostname. Delivery relies on user interaction consistent with a phishing scenario. No authentication is required by the attacker, and no privileges are needed on the target system.

python

# Patch excerpt: eml_parser/regexes.py from commit 746a69f
# Splits the email regex into TLD-optional and TLD-required variants.

# W3C HTML5 standard recommended regex for e-mail validation
email_no_force_tld_regex = re.compile(
    r"""([a-zA-Z0-9.!#$%&'*+-/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)""",
    re.MULTILINE,
)
email_force_tld_regex = re.compile(
    r"""([a-zA-Z0-9.!#$%&'*+-/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)+)""",
    re.MULTILINE,
)
email_regex = email_no_force_tld_regex

# Patch excerpt: eml_parser/parser.py — resilient address header parsing
elif header in ('sender', 'resent-sender', 'to', 'resent-to', 'cc',
                'resent-cc', 'bcc', 'resent-bcc', 'from', 'resent-from',
                'reply-to'):
    try:
        return super().header_fetch_parse(name, value)
    except RecursionError:
        # Pathological header; fall back to regex extraction.
        m = eml_parser.regexes.email_regex.findall(value)
        return ', '.join(m)

Source: GitHub commit 746a69f

Detection Methods for CVE-2026-55618

Indicators of Compromise

Inbound HTML emails containing anchor href values with HTML entities such as :, /, or . substituting for :, /, or . in URLs.
Discrepancies between rendered URLs in a mail preview and URLs present in the parser's extracted IOC list.
User-clicked outbound web traffic to domains that never appeared in prior email IOC feeds despite the message originating from a parsed email.

Detection Strategies

Re-run archived emails through eml_parser 3.0.2 and diff extracted URL and domain lists against the previous parser output to surface previously hidden indicators.
Add a pre-processing step that HTML-unescapes message bodies before or in parallel with URL extraction, then compare results.
Alert when HTML entity sequences representing URL structural characters appear inside <a href="..."> attributes or plaintext URL candidates.

Monitoring Recommendations

Track the version of eml_parser deployed across mail security, DFIR, and SOAR components; flag any host still running a version prior to 3.0.2.
Correlate proxy or DNS logs with email IOC submissions to identify user traffic to domains that were present in messages but absent from extracted IOC feeds.
Monitor threat intelligence submission rates per parsed message; sudden drops may indicate encoded URLs are being dropped upstream.

How to Mitigate CVE-2026-55618

Immediate Actions Required

Upgrade eml_parser to version 3.0.2 or later across every host, container, and pipeline that ingests email.
Rebuild and redeploy any downstream services, SOAR playbooks, or container images that pin an earlier eml_parser release.
Reprocess recent email archives with the patched version and forward any newly discovered URLs and domains to reputation and sandbox services.

Patch Information

The fix is included in eml_parser 3.0.2, released by GOVCERT-LU. Details are available in the GitHub Security Advisory GHSA-fxgq-9m89-cxj9, the v3.0.2 release notes, pull request #90, and the remediation commit.

Workarounds

If immediate upgrade is not possible, add a wrapper that HTML-unescapes message bodies before passing them to eml_parser and merges the resulting URLs with the parser's output.
Route parsed emails through an independent URL extractor that operates on decoded HTML to cross-check eml_parser results.
Strip or normalize HTML entities inside anchor href attributes at the gateway before IOC extraction runs.

bash

# Upgrade eml_parser to the fixed release
pip install --upgrade 'eml_parser>=3.0.2'

# Verify the installed version
python -c "import eml_parser; print(eml_parser.__version__)"

# Optional: pin the fixed version in requirements.txt
echo 'eml_parser>=3.0.2' >> requirements.txt