---
id: CVE-2026-55618
aliases:
  - GHSA-fxgq-9m89-cxj9
  - PYSEC-2026-3831
title: eml_parser has a URL extraction bypass via HTML entities in URLs
summary: eml_parser has a URL extraction bypass via HTML entities in URLs
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
vendor: eml-parser
product: eml-parser
ecosystem: pip
affected:
  - eml-parser < 3.0.2
patched:
  - eml-parser 3.0.2
published: '2026-08-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T12:25:30.107146456Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fxgq-9m89-cxj9'
references:
  - url: >-
      https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-fxgq-9m89-cxj9
  - url: 'https://github.com/GOVCERT-LU/eml_parser/pull/90'
  - url: >-
      https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
  - url: 'https://github.com/GOVCERT-LU/eml_parser'
  - url: 'https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2'
  - url: 'https://pypi.org/project/eml-parser'
  - url: 'https://github.com/advisories/GHSA-fxgq-9m89-cxj9'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55618'
tags:
  - osv
  - pip
  - nvd
  - ghsa
epss: 0.00515
epssPercentile: 0.41507
cwe:
  - CWE-116
ingestedAt: '2026-08-25T18:30:21.077Z'
---

## Overview

## Summary

`eml_parser` performs certain validations on potential URL strings to discard bogus values. In versions prior to `3.0.2`, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML entities for the `:`, `/`, or `.` characters. These URLs would then not be included in the list of extracted URLs. Similarly, the host parts of such URLs would not be extracted.

For example, neither the URL `https&#58;&#47;&#47;phishing&#46;example&#46;com` nor its host (`phishing.example.com`) would appear in the parsing result.

## Impact

`eml_parser` is used in email security gateways and SOC pipelines to extract URLs as IOCs. Those URLs are then checked against threat-intel feeds, URL reputation services, and sandboxes. A URL that is not extracted is never checked.

## Patches

Since version 3.0.2 the library unescapes all HTML entities in every URL before deciding to accept or reject it. A test was added to prevent regressions.

## Affected packages

- `eml-parser < 3.0.2`

## Remediation

Upgrade to a patched release:

- `eml-parser 3.0.2`