Email-derived URL path injection in the Swoosh Microsoft Graph adapter (CVE-2026-54893) | HOL Guard CVE

Low · CVSS 2.1CVE-2026-54893

Email-derived URL path injection in the Swoosh Microsoft Graph adapter

Answer in brief

CVE-2026-54893 records a Low severity (CVSS 2.1) vulnerability in Email-derived URL path injection in the Swoosh Microsoft Graph adapter. The current sources do not mark it as known exploited. The current feed maps swoosh/swoosh (generic), swoosh/swoosh/swoosh (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jul 6, 2026Updated Sep 24, 2026Source checked Sep 25, 2026First seen by HOL Jul 6, 2026Material review Sep 24, 2026

Upstream Advisory

Key facts

Risk: Low · CVSS 2.1
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 2.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps swoosh/swoosh (generic), swoosh/swoosh/swoosh (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
swoosh/swooshgeneric	>=1.12.0 <1.26.3	1.26.3
swoosh/swoosh/swooshgeneric	>=23bfcdab71aee4613858ba6d116bb3311b72aa58 <e38235453e81d1727bfc8d91e69ec4cb211ccf61	e38235453e81d1727bfc8d91e69ec4cb211ccf61

Recommended response

Check inventory. Check lockfiles and deployed manifests for swoosh/swoosh, swoosh/swoosh/swoosh.
Review the reported fix. Source-reported workaround: Validate or reject sender addresses that contain characters outside the allowed RFC 5321 set (in particular /, ?, #, and ..) before passing the email to the adapter. Alternatively, set a static :url in the adapter configuration, which bypasses interpolation of the from address into the request path.

Evidence timeline and material changes

Published upstream
Jul 6, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 6, 2026

Sources and claim methodology

Upstream source description

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature), an attacker can place URL-special characters such as /, ?, or # in the local part of the address to escape the intended path segment and rewrite the path and query string of the request. Because the same authenticated POST is sent with the application's Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes and control the request's query string. Applications that always use a fixed, trusted from address are not affected. This issue affects swoosh: from 1.12.0 before 1.26.3.

Quoted source text, attributed separately from HOL analysis.