swoosh
Compose, deliver and test your emails easily in Elixir
View on Github
Activity
- Latest release
- 20h ago
- Total releases
- 182
- Cadence
- ~13 days
- Last 12 months
- 24
Reach
- Downloads
- 23.5M
- Stars
- 1.5k
Details
- License
- MIT
- First release
- Mar 21, 2016
| Version | Released | |
|---|---|---|
1.29.3
patch
|
1.29.3
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.29.2
patch
|
1.29.2
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.29.0
minor
|
1.29.0
minor
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.28.1
patch
|
1.28.1
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.28.0
minor
|
1.28.0
minor
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.27.1
patch
|
1.27.1
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.27.0
minor
|
1.27.0
minor
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.26.3
patch
|
1.26.3
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.26.2
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev |
1.26.2
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.26.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev |
1.26.1
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.26.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev |
1.26.0
minor
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.25.3
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev |
1.25.3
patch
Dependencies (16)
+ 8 more
Changelog
Compare changes
|
|
1.25.2
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.25.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.25.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.24.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.23.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.23.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.22.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.22.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.21.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.20.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.20.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.9
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.8
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.7
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.6
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.5
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.4
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.3
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.2
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.19.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.18.4
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.18.3
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.18.2
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.18.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.18.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.10
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.9
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.8
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.7
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.6
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.5
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.4
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.3
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.2
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.1
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.17.0
minor
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev | ||
1.16.12
patch
1 CVE
CVE-2026-54893
GHSA-754j-98wh-57rf
EEF-CVE-2026-54893
Oct 16, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint
Low
Local
Low
None
None
Summary
DetailsThe flaw is in Because the address sits as the local part of PoC
ImpactAn attacker who can influence the sender address can redirect an application's authenticated Microsoft Graph requests to other endpoints within the bearer token's scopes and control the request's query string, turning the mail-sending path into a constrained server-side request forgery against the Graph API. References
Affected versions
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
+ 53 more Show less
1.16.1
1.16.10
1.16.11
1.16.12
1.16.2
1.16.3
1.16.4
1.16.5
1.16.6
1.16.7
1.16.8
1.16.9
1.17.0
1.17.1
1.17.10
1.17.2
1.17.3
1.17.4
1.17.5
1.17.6
1.17.7
1.17.8
1.17.9
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7
1.19.8
1.19.9
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.25.2
1.25.3
1.26.0
1.26.1
1.26.2
Fixed in
1.26.3
References
Updated Oct 16, 2026 · Source: OSV.dev |