Vulnerability in eml_parser (CVE-2026-55618)
Summary
Vulnerability in eml_parser (CVE-2026-55618). Data can be tampered with by attackers. Exploitable via eml_parser. Mitigation: upgrade to 3.0.2 or later.
Original description
The description as published by the source.
Summary
eml_parser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML entities for the :, /, or . characters. These URLs would then not be included in the list of extracted URLs. Similarly, the host parts of such URLs would not be extracted.
For example, neither the URL https://phishing.example.com nor its host (phishing.example.com) would appear in the parsing result.
Impact
eml_parser is used in email security gateways and SOC pipelines to extract URLs as IOCs. Those URLs are then checked against threat-intel feeds, URL reputation services, and sandboxes. A URL that is not extracted is never checked.
Patches
Since version 3.0.2 the library unescapes all HTML entities in every URL before deciding to accept or reject it. A test was added to prevent regressions.
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-55618 has been found in eml_parser.
Attackers can target a specific entry point like eml_parser over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 6.5/10.
What to do: upgrade eml_parser to 3.0.2 or later.
If unsure, ask your IT team or search "eml_parser CVE-2026-55618" on the vendor's site.
CVE-2026-55618 (eml_parser) — CWE-116 / CVSS v3 6.5
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: eml_parser / phishing.example.com
Patched: 3.0.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-116) exists in eml_parser. Attackers reach the vulnerable code path via eml_parser without authentication.
Check the vendor advisory for the affected versions of eml_parser. Attack surface: eml_parser / phishing.example.com.
Severity: Medium (CVSS 6.5/10). Data can be tampered with by attackers.
Update to 3.0.2.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'eml_parser' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'eml_parser' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
eml_parserを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade eml_parser to 3.0.2ステージング環境で 3.0.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。