ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-54893

swoosh has email-derived URL path injection in Microsoft Graph endpoint

Published Jul 6, 2026 · catalog updated Oct 16, 2026 · swoosh has email-derived URL

Check if you run it

No confirmed exploitation is on record for CVE-2026-54893. EPSS is 0.20%. Act only if a listed version of swoosh has email-derived URL is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (swoosh has email-derived URL).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low2.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.20%
Remediation
Version ranges on file
Affected products
Hex swoosh · erlang swoosh · vendor swoosh swoosh

### Summary builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path ( ) without percent-encoding or validation. In applications that derive the address from untrusted or user-influenced input (a relay, a contact form, or a "send as" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and query string. Because the rewritten request is still sent as the application's authenticated with its Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes. ### Details The flaw is in . constructs the Graph endpoint by interpolating the email's address into the path . The value is taken verbatim from the email struct and is neither percent-encoded nor validated against the RFC 5321 character set before being placed into the URL. then issues an authenticated to that constructed URL using the application's Graph bearer token. Because the address sits as the local part of , characters such as , , and are not neutralized. A lets the attacker append or replace additional path segments, a starts an attacker-controlled query string, and truncates the remainder of the intended path. The result is that the authenticated request can be steered to a different Graph endpoint or carry attacker-chosen query parameters, all under the token's existing scopes. Applications that always send with a fixed, trusted address never reach the injectable path and are unaffected. ### PoC 1. Configure an application to use and derive the email address from user-influenced input (e.g. a contact form's reply address or a "send as" field). 2. Submit a address whose local part contains URL-special characters, for example one using , , or to escape the path segment. 3. Trigger delivery; Swoosh interpolates the address unencoded and sends the application's authenticated Graph to the attacker-rewritte

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex swoosh1.12.0 → 1.26.3
  • erlang swoosh>= 1.12.0, < 1.26.3
  • vendor swoosh swooshversion unspecified

How to fix CVE-2026-54893

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-54893. EPSS is 0.20%. Act only if a listed version of swoosh has email-derived URL is installed.

Which versions are affected?

Compare what you have installed with 1.12.0 → 1.26.3, >= 1.12.0, < 1.26.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-116; CWE-1284; CWE-789. EPSS 0.20%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ### Summary builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path ( ) without percent-encoding or validation. In applications that derive the address from untrusted or user-influenced input (a relay, a contact form, or a "send as" feature), an attacker can inject URL-special characters into the local part of the address to escape the inte

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    swoosh fixed in 1.26.3

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    swoosh fixed in 1.26.3

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ### Summary builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path ( ) without percent-encoding or validation. In applications that derive the address from untrusted or user-influenced input (a relay, a contact form, or a "send as" feature), an attacker can inject URL-special characters into the local part of the address to escape the inte

Sources

  • CVE.orgVulnerability recordCVE-2026-54893

    URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that deri

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-54893

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-754j-98wh-57rf

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-754j-98wh-57rf

    swoosh has email-derived URL path injection in Microsoft Graph endpoint

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.