CVE-2026-55618: CWE-116: Improper Encoding or Escaping of Output in GOVCERT-LU eml_parser

The eml_parser module, used for parsing .eml email files, had a flaw in its clean_found_uri function before version 3.0.2. This function incorrectly validated URLs by unescaping HTML entities for colon, slash, or period characters before validation, causing valid encoded URLs to be rejected and omitted from URL and domain extraction. This omission can lead to security tools missing malicious URLs embedded in emails, potentially allowing threats to evade detection. The issue is addressed by correcting the validation logic in version 3.0.2.

The vulnerability does not directly compromise confidentiality or availability but impacts the integrity of threat detection processes. Malicious URLs encoded in emails may be omitted from detection lists, causing email security gateways and SOC pipelines to miss indicators of compromise. This can allow malicious links to bypass threat intelligence feeds, reputation services, or sandbox analysis, increasing the risk of successful phishing or malware delivery.

Upgrade to eml_parser version 3.0.2 or later, where the issue is fixed. No other mitigations are indicated by the vendor advisory. Users relying on URL extraction from eml_parser should ensure they apply this update to maintain accurate detection of encoded URLs.