THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-fxgq-9m89-cxj9 (medium) — eml_parser has a URL extraction bypass via HTML entities in URLs

[GHSA] GHSA-fxgq-9m89-cxj9 (medium) — eml_parser has a URL extraction bypass via HTML entities in URLs

medgithub_advisoriesPublished 2026-08-25

GHSA-fxgq-9m89-cxj9 Severity: medium CVE: CVE-2026-55618

eml_parser has a URL extraction bypass via HTML entities in URLs

## Summary

`eml_parser` performs certain validations on potential URL strings to discard bogus values. In versions prior to `3.0.2`, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject

Indicators of compromise

CVE-2026-55618cve

Original source: https://github.com/advisories/GHSA-fxgq-9m89-cxj9