{"id":"ghsa-ghsa-754j-98wh-57rf","seq":2457,"kind":"advisory","title":"swoosh has email-derived URL path injection in Microsoft Graph endpoint","url":"https://github.com/advisories/GHSA-754j-98wh-57rf","permalink":"https://vulnpulse.app/items/ghsa-ghsa-754j-98wh-57rf","summary":"影響: erlang:swoosh >= 1.12.0, < 1.26.3 → 1.26.3\nSummary Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (a relay, a contact form, or a \"send as\" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and…","severity":"low","techs":["erlang"],"cves":["CVE-2026-54893"],"tags":["GHSA-754j-98wh-57rf","swoosh"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-16T19:22:31.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}