Listen to this Post
Technical
eml_parser is a Python module developed by GOVCERT-LU that parses EML files and extracts various pieces of information from emails, including URLs, domains, attachments, and headers. The library is widely used in email security gateways and Security Operations Center (SOC) pipelines to extract URLs as Indicators of Compromise (IOCs), which are then submitted to threat intelligence feeds, URL reputation services, and sandboxes for malicious link detection.
A vulnerability exists in versions prior to 3.0.2 within the `clean_found_uri` function located in eml_parser/parser.py. This function is responsible for validating potential URL strings and discarding bogus values before they are added to the extracted URL list. The flaw lies in the order of operations: the validation is performed before unescaping any HTML entities that might appear in the URL string.
HTML entities are character representations used in HTML—for example, `&58;` represents a colon (:), `&47;` represents a slash (/), and `&46;` represents a period (.). An attacker can craft a URL such as `https&58;//phishing&46;example&46;com` instead of https://phishing.example.com`. When the `clean_found_uri` function processes this string, it validates it before converting the HTML entities back to their original characters. Because the string contains HTML entities rather than the expected colon, slash, and period characters, the validation logic incorrectly classifies it as a bogus or invalid URL and rejects it.https://phishing.example.com`) nor its host (
As a result, the URL is omitted from the extracted URL and domain lists entirely. Neither the full URL (phishing.example.com) appears in the parsing result. This creates a blind spot in email security pipelines: malicious links that should be flagged and blocked are never submitted to threat intelligence feeds for inspection, allowing them to bypass detection. The vulnerability is fixed in version 3.0.2, where the library now unescapes all HTML entities in every URL before deciding to accept or reject it.
DailyCVE Form:
Platform: eml_parser (Python)
Version: < 3.0.2
Vulnerability: URL extraction bypass
Severity: Medium (CVSS 6.5)
Date: 2026-08-25
Prediction: Patch released (2026-08-25)
What Undercode Say:
Analytics:
Check installed eml_parser version pip show eml_parser | grep Version List all installed packages with version pip list | grep eml_parser Upgrade to patched version pip install --upgrade eml_parser>=3.0.2
Detection snippet (pre-patch behavior):
from eml_parser import eml_parser This URL uses HTML entities for : / . malicious_url = "https&58;//phishing&46;example&46;com" In versions < 3.0.2, clean_found_uri validates before unescaping The URL is rejected and does not appear in extracted list
Verification (post-patch):
from eml_parser import eml_parser In version 3.0.2+, HTML entities are unescaped before validation The URL is correctly extracted and flagged
Exploit: (Educational Purposes!)
An attacker can embed a malicious URL using HTML entities for the colon, slash, and period characters within an email body or header:
Original URL: https://phishing.example.com/malware Encoded URL: https&58;//phishing&46;example&46;com&47;malware
When processed by eml_parser versions prior to 3.0.2:
1. `clean_found_uri` receives the encoded string
2. Validation runs before HTML entity decoding
- The function sees
&58;,&46;, and `&47;` instead of:,., and `/`
4. The URL is classified as invalid and discarded - The URL never appears in the extracted URL or domain lists
- The malicious link is never checked against threat intelligence feeds
Protection:
- Upgrade eml_parser to version 3.0.2 or later immediately
- Restart all services that use the library to ensure the updated code is active
- If an upgrade cannot be performed immediately, modify the email processing pipeline to flag or expand URLs containing HTML entities before passing them to threat intelligence feeds
- Review integration points with any third-party email parsing libraries to verify updates have been applied consistently
- Implement defense-in-depth strategies such as heuristic analysis and behavioral monitoring to help detect malicious URLs even if extraction is bypassed
Impact:
- Email security gateways and SOC pipelines fail to extract malicious URLs that use HTML entity encoding
- Hidden URLs are not submitted to threat intelligence feeds, reputation services, or sandboxes
- Malicious links evade detection and reach end-user mailboxes
- Increased risk of successful phishing attacks (MITRE ATT&CK T1566)
- Organizations lose visibility into active campaigns targeting their users
- The vulnerability aligns with CWE-116: Improper Encoding or Escaping of Output
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
