{"answers":{"affected":"3 open source packages ship an affected version, including swoosh.","exploited":"There is no known exploitation of CVE-2026-54893 in the wild and no public exploit code.","fix":"Upgrade swoosh to 1.26.3 or later.","what":"CVE-2026-54893 is a low-severity server-side request forgery vulnerability in swoosh, published on 6 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54893 and fix it if it is affected.\n\nWhat it is: CVE-2026-54893 is a low-severity server-side request forgery vulnerability in swoosh, published on 6 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54893 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- swoosh (Hex): affected from 1.12.0; fixed in 1.26.3\n- swoosh (Hex): affected from 1.12.0; fixed in 1.26.3\n- swoosh (Hex): affected from 1.12.0; fixed in 1.26.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54893/ (Markdown: https://insights.sbomify.com/CVE-2026-54893/index.md)","id":"CVE-2026-54893","markdown":"https://insights.sbomify.com/CVE-2026-54893/index.md","name":"CVE-2026-54893","record":{"aliases":["EEF-CVE-2026-54893","GHSA-754j-98wh-57rf"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Elixir email library","requires_auth":"none","summary":"Attackers can inject URL characters into email addresses to redirect Microsoft Graph API requests, potentially accessing or modifying data within token scopes.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":2.1,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0"},"cwes":[{"id":"CWE-116","name":"Improper Encoding or Escaping of Output"}],"description":"URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation.\n\nIn applications that derive the from address from untrusted or user-influenced input (for example a relay, a contact form, or a \"send as\" feature), an attacker can place URL-special characters such as /, ?, or # in the local part of the address to escape the intended path segment and rewrite the path and query string of the request. Because the same authenticated POST is sent with the application's Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes and control the request's query string. Applications that always use a fixed, trusted from address are not affected.\n\nThis issue affects swoosh: from 1.12.0 before 1.26.3.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Email-derived URL path injection in the Swoosh Microsoft Graph adapter","id":"CVE-2026-54893","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":3,"n_references":5,"next":{"headline":"Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys","id":"CVE-2026-54894"},"packages":[{"ecosystem":"Hex","fixed":["1.26.3"],"introduced":["1.12.0"],"last_affected":[],"package":"swoosh","purl":"pkg:hex/swoosh","source":"EEF-CVE-2026-54893"},{"ecosystem":"Hex","fixed":["1.26.3"],"introduced":["1.12.0"],"last_affected":[],"package":"swoosh","purl":null,"source":"GHSA-754j-98wh-57rf"},{"ecosystem":"Hex","fixed":["1.26.3"],"introduced":["1.12.0"],"last_affected":[],"package":"swoosh","purl":"pkg:hex/swoosh","source":"GHSA-754j-98wh-57rf"}],"prev":{"headline":"Plug: quadratic-time decoding of nested query/body parameters enables denial of service","id":"CVE-2026-54892"},"products":["swoosh"],"published":"2026-07-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-24","vendors":["swoosh"]},"summary":"Attackers can inject URL characters into email addresses to redirect Microsoft Graph API requests, potentially accessing or modifying data within token scopes.","url":"https://insights.sbomify.com/CVE-2026-54893/"}