Hex/swoosh CVE-2026-54893: low 2.1, EPSS 0.20%
Email-derived URL path injection in the Swoosh Microsoft Graph adapter
Action: Upgrade swoosh to 1.26.3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.12.0 | 1.26.3 | - |
Fixed versions
| 1.26.3 |
Sources
- osv: EEF-CVE-2026-54893
- nvd: CVE-2026-54893
- https://github.com/swoosh/swoosh/security/advisories/GHSA-754j-98wh-57rf
- https://cna.erlef.org/cves/CVE-2026-54893.html
- https://github.com/swoosh/swoosh/commit/23bfcdab71aee4613858ba6d116bb3311b72aa58
- https://github.com/swoosh/swoosh/commit/e38235453e81d1727bfc8d91e69ec4cb211ccf61
- https://hex.pm/packages/swoosh
CVE-2026-54893 · published · modified · JSON