CVE-2026-54893: Swoosh Package Email-Derived URL Path Injection Vulnerability
Summary
CVE-2026-54893: Email-derived URL path injection in the Swoosh Microsoft Graph adapter. Affects swoosh across 2 version ranges.
>= 1.12.0, < 1.26.3
>= 23bfcdab71aee4613858ba6d116bb3311b72aa58, < e38235453e81d1727bfc8d91e69ec4cb211ccf61
Fixed in 1.26.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Swoosh is an open-source library designed for sending emails in Elixir applications. It provides various adapters to facilitate email delivery through different services, including Microsoft Graph. The library allows developers to easily integrate email functionality into their applications, but it also introduces potential security risks if not configured properly. This vulnerability specifically affects the Swoosh.Adapters.MsGraph adapter, which constructs API request URLs using user-provided email addresses.
Vulnerability Detail
The vulnerability arises from the way Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by directly interpolating the sender's email address into the URL path without proper validation or percent-encoding. This allows an attacker to manipulate the email address input, potentially injecting URL-special characters (such as /, ?, or #) to escape the intended path segment. Consequently, the attacker can redirect the request to unauthorized Graph endpoints within the token's scopes, leading to unauthorized access or data manipulation. Applications that derive the 'from' address from untrusted input are particularly at risk.
How To Fix
Latest published version: 1.29.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.26.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, validate or reject sender addresses that contain characters outside the allowed RFC 5321 set (particularly /, ?, #, and ..) before passing the email to the adapter. Alternatively, you can configure the adapter to use a static URL, bypassing the interpolation of the 'from' address. Example configuration:
config :swoosh, Swoosh.Adapters.MsGraph, url: "https://graph.microsoft.com/v1.0/users/static_email@example.com/sendMail"
Conclusion
The CVE-2026-54893 vulnerability in the Swoosh package poses a significant risk for applications that derive email addresses from untrusted input. It is crucial to update to the latest version or implement workarounds to mitigate potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for swoosh →
FAQ
CVE-2026-54893 is a vulnerability in the Swoosh package that allows for email-derived URL path injection in the Microsoft Graph adapter.
If your application derives the 'from' email address from untrusted input, it may be susceptible to unauthorized access or manipulation of requests sent to Microsoft Graph.
The vulnerability affects Swoosh versions from 1.12.0 up to, but not including, 1.26.3.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
Implement the recommended workarounds, such as validating sender addresses or using a static URL configuration, until you can update to the patched version.
