The vulnerability lies in the eml_parser library’s URL extraction routine. The clean_found_uri function verifies potential URLs before unescaping HTML entities that encode colon, slash, or period characters, and discards any string that contains those encoded characters. As a result, legitimate URLs that use HTML entities to obfuscate protocol and path separators are removed from the extracted URL and domain lists. This omission allows malicious links embedded in email messages to evade detection by security gateway systems, reputation services, and sandboxing solutions that rely on these lists, thereby enabling an attacker to deliver hidden URLs without triggering threat intelligence.

The vulnerable product is eml_parser from GOVCERT-LU. All releases before 3.0.2 are affected. A patch is available in release 3.0.2 and later; no further version details are provided.

The CVSS score of 6.5 indicates medium severity. EPSS is not available and the vulnerability is not listed in CISA KEV, implying that exploitation has not yet been observed in the wild. The attack is likely to occur in environments where the library processes inbound .eml files, such as email security gateways or SOC pipelines. An attacker who can inject a crafted email can cause malicious URLs to be omitted from detection, potentially leading to undetected phishing or malware delivery. The lack of an exploit in public sources suggests that while the risk is non‑zero, the likelihood of active exploitation is currently low.