CVE-2026-55618

Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2

Description The clean found uri() function in eml parser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. This causes valid encoded URLs and their host names to be rejected and omitted from extracted URL and domain lists. Consequently, security gateways and SOC pipelines relying on these lists as indicators of compromise may fail to submit hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection.

Recommendations Update to version 3.0.2.