swoosh

Compose, deliver and test your emails easily in Elixir

View on Hex

View on Github

Activity

Latest release: 3w ago
Total releases: 178
Cadence: ~12 days
Last 12 months: 20

Reach

Downloads: 21.7M
Stars: 1.5k

Details

License: MIT
First release: Mar 21, 2016

Releases

Version	Released
`1.28.0` minor	Aug 23, 2026
`1.27.1` patch	Aug 15, 2026
`1.27.0` minor	Jul 29, 2026
`1.26.3` patch	Jul 05, 2026
`1.26.2` patch 1 CVE	Jun 25, 2026
`1.26.1` patch 1 CVE	Jun 04, 2026
`1.26.0` minor 1 CVE	May 30, 2026
`1.25.3` patch 1 CVE	May 26, 2026
`1.25.2` patch 1 CVE	May 11, 2026
`1.25.1` patch 1 CVE	Apr 29, 2026
`1.25.0` minor 1 CVE	Apr 02, 2026
`1.24.0` minor 1 CVE	Mar 23, 2026
`1.23.1` patch 1 CVE	Mar 17, 2026
`1.23.0` minor 1 CVE	Mar 05, 2026
`1.22.1` patch 1 CVE	Feb 25, 2026
`1.22.0` minor 1 CVE	Feb 19, 2026
`1.21.0` minor 1 CVE	Jan 21, 2026
`1.20.1` patch 1 CVE	Jan 19, 2026
`1.20.0` minor 1 CVE	Dec 26, 2025
`1.19.9` patch 1 CVE	Dec 09, 2025
`1.19.8` patch 1 CVE	Sep 25, 2025
`1.19.7` patch 1 CVE	Sep 24, 2025
`1.19.6` patch 1 CVE	Sep 21, 2025
`1.19.5` patch 1 CVE	Jul 29, 2025
`1.19.4` patch 1 CVE	Jul 26, 2025
`1.19.3` patch 1 CVE	Jun 19, 2025
`1.19.2` patch 1 CVE	Jun 11, 2025
`1.19.1` patch 1 CVE	May 15, 2025
`1.19.0` minor 1 CVE	May 01, 2025
`1.18.4` patch 1 CVE	Mar 31, 2025
`1.18.3` patch 1 CVE	Mar 21, 2025
`1.18.2` patch 1 CVE	Mar 08, 2025
`1.18.1` patch 1 CVE	Mar 05, 2025
`1.18.0` minor 1 CVE	Mar 03, 2025
`1.17.10` patch 1 CVE	Feb 06, 2025
`1.17.9` patch 1 CVE	Feb 02, 2025
`1.17.8` patch 1 CVE	Feb 01, 2025
`1.17.7` patch 1 CVE	Jan 31, 2025
`1.17.6` patch 1 CVE	Dec 31, 2024
`1.17.5` patch 1 CVE	Dec 15, 2024
`1.17.4` patch 1 CVE	Dec 11, 2024
`1.17.3` patch 1 CVE	Nov 07, 2024
`1.17.2` patch 1 CVE	Oct 04, 2024
`1.17.1` patch 1 CVE	Sep 14, 2024
`1.17.0` minor 1 CVE	Sep 05, 2024
`1.16.12` patch 1 CVE	Aug 20, 2024
`1.16.11` patch 1 CVE	Aug 20, 2024
`1.16.10` patch 1 CVE	Jul 19, 2024
`1.16.9` patch 1 CVE	May 30, 2024
`1.16.8` patch 1 CVE	May 29, 2024

1–50 of 178

Repository

swoosh/swoosh

Forks: 261
Open issues: 12
Language: Elixir
: 4.6/ 10

elixir
email

Dependencies (16)

Depends on

1.28.0

Used by

Supply-chain exposure

71 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-54893 EEF-CVE-2026-54893 GHSA-754j-98wh-57rf Jul 06, 2026

Email-derived URL path injection in the Swoosh Microsoft Graph adapter

Medium
Local Low None None

Summary

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation.

In applications that derive the from address from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature), an attacker can place URL-special characters such as /, ?, or # in the local part of the address to escape the intended path segment and rewrite the path and query string of the request. Because the same authenticated POST is sent with the application's Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes and control the request's query string. Applications that always use a fixed, trusted from address are not affected.

This issue affects swoosh from 1.12.0 before 1.26.3.

Workarounds

Validate or reject sender addresses that contain characters outside the allowed RFC 5321 set (in particular /, ?, #, and ..) before passing the email to the adapter. Alternatively, set a static :url in the adapter configuration, which bypasses interpolation of the from address into the request path.

Configurations

This vulnerability only affects applications that use Swoosh.Adapters.MsGraph and derive the email "from" address from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature). Applications that always send with a fixed, trusted "from" address are not affected.

Affected versions

1.12.01.13.01.14.01.14.11.14.21.14.31.14.41.15.01.15.11.15.21.15.31.16.0

+ 53 more Show less

1.16.11.16.101.16.111.16.121.16.21.16.31.16.41.16.51.16.61.16.71.16.81.16.91.17.01.17.11.17.101.17.21.17.31.17.41.17.51.17.61.17.71.17.81.17.91.18.01.18.11.18.21.18.31.18.41.19.01.19.11.19.21.19.31.19.41.19.51.19.61.19.71.19.81.19.91.20.01.20.11.21.01.22.01.22.11.23.01.23.11.24.01.25.01.25.11.25.21.25.31.26.01.26.11.26.2

Fixed in

1.26.3

References

https://github.com/swoosh/swoosh/security/advisories/GHSA-754j-98wh-57rf
https://cna.erlef.org/cves/CVE-2026-54893.html
https://github.com/swoosh/swoosh/commit/e38235453e81d1727bfc8d91e69ec4cb211ccf61
https://hex.pm/packages/swoosh

Updated Sep 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 52
patch 124

178 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More