Esse artigo parece promissor

https://lab.ctbb.show/research/parse-and-parse-mime-validation-bypass-to-xss-via-parser-differential

Saiu faz pouco