Description

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the clean_found_uri function in eml_parser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. Valid encoded URLs and their host names are therefore rejected and omitted from the extracted URL and domain lists. Email security gateways and SOC pipelines that use those lists as indicators of compromise may fail to submit the hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection. This issue is fixed in version 3.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T19:16:50.323Z",
  "pubdate": "2026-08-25T19:16:50.323Z",
  "executiveSummary": "A security bypass vulnerability exists in the eml_parser Python module due to improper validation logic within the clean_found_uri function. The vulnerability allows attackers to embed malicious URLs using HTML entity encoding to evade detection mechanisms.\nThis flaw affects versions prior to 3.0.2. The primary security impact involves the failure of automated email security gateways and Security Operations Center (SOC) pipelines to extract and analyze hidden, encoded URLs.\nBy bypassing the parsing logic, malicious links remain undetected during the email ingestion process, preventing them from being submitted to threat intelligence feeds, reputation services, or automated sandboxing environments.\nThis creates a critical detection gap, enabling threat actors to deliver payloads or phishing lures that evade standard inspection controls. The vulnerability does not require authentication or elevated privileges to exploit, as the weakness resides within the parser’s processing logic. Attackers can leverage this by crafting emails containing obfuscated links, ensuring these indicators of compromise (IoCs) are omitted from the parser’s output, thereby rendering downstream security controls ineffective.",
  "technicalDetails": "The vulnerability resides in the clean_found_uri function within the eml_parser/parser.py file. The core issue stems from an incorrect order of operations during the URL validation and sanitization process. Specifically, the parser validates potential URL strings before performing necessary unescaping of HTML entities that may represent critical structural characters such as colons (':'), slashes ('/'), or periods ('.').\nIn the affected versions (prior to 3.0.2), the validator executes strict checks on the raw string retrieved from the email content. If an attacker encodes characters within a URL using HTML entities, the resulting string does not match the expected format of a standard URL during the validation phase. Consequently, the function rejects the URL as invalid, causing the parser to omit both the full URL and the associated hostname from the returned object.\nThe attack flow follows a predictable pattern: 1) The attacker crafts an email containing a malicious URL where key characters are obfuscated via HTML entities (e.g., using : for colon or / for slash). 2) The email is processed by an automated security pipeline that relies on eml_parser for indicator extraction. 3) The eml_parser’s clean_found_uri function evaluates the encoded URL, determines it does not conform to the expected syntax due to the presence of HTML entities, and drops the entry. 4) The pipeline continues without the malicious link in its output, effectively blinding the downstream security infrastructure. 5) Threat intelligence feeds and sandbox analysis tools never receive the malicious link, allowing the email to bypass reputation-based filtering or malicious content inspection.\nThis vulnerability is essentially a logic flaw in input processing that effectively creates a sandbox escape or filter evasion. Because the parser is frequently used in high-volume SOC pipelines, this failure to normalize input before validation provides a significant reliability gap in enterprise email security postures. The lack of proper decoding mechanisms before validation ensures that the parser remains unable to identify or extract these obfuscated IoCs, regardless of how transparent the obfuscation might be to a human analyst or a more robust parser. The fix in version 3.0.2 likely addresses this by ensuring proper HTML entity decoding occurs prior to or during the normalization and validation phase, allowing the parser to reconstruct the intended URL accurately before determining its validity."
}