chore(deps): update dependency swoosh to v1.26.3 [security] #583
No reviewers
Labels
No labels
bug
duplicate
enhancement
help wanted
high priority
invalid
L
low priority
M
medium priority
needs refinement
optional
question
S
security
technical improvement
UX Improvement
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
local-it/mitgliederverwaltung!583
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/hex-swoosh-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.25.1→1.26.3Email-derived URL path injection in the Swoosh Microsoft Graph adapter
CVE-2026-54893 / EEF-CVE-2026-54893 / GHSA-754j-98wh-57rf
More information
Details
Summary
URL path injection in the Microsoft Graph adapter of Swoosh.
Swoosh.Adapters.MsGraphbuilds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation.In applications that derive the
fromaddress from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature), an attacker can place URL-special characters such as/,?, or#in the local part of the address to escape the intended path segment and rewrite the path and query string of the request. Because the same authenticatedPOSTis sent with the application's Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes and control the request's query string. Applications that always use a fixed, trustedfromaddress are not affected.This issue affects swoosh: from 1.12.0 before 1.26.3.
Workarounds
Validate or reject sender addresses that contain characters outside the allowed RFC 5321 set (in particular
/,?,#, and..) before passing the email to the adapter. Alternatively, set a static:urlin the adapter configuration, which bypasses interpolation of thefromaddress into the request path.Configurations
This vulnerability only affects applications that use
Swoosh.Adapters.MsGraphand derive the emailfromaddress from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature). Applications that always send with a fixed, trustedfromaddress are not affected.Severity
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by OSV.
Release Notes
swoosh/swoosh (swoosh)
v1.26.3Compare Source
🔒 Security
v1.26.2Compare Source
🐛 Bug Fixes
v1.26.1Compare Source
🐛 Bug Fixes
cidhandling for Mailpit adapter @waseigo (#1155)v1.26.0Compare Source
✨ Features
📝 Documentation
v1.25.3Compare Source
📝 Documentation
🧰 Maintenance
v1.25.2Compare Source
🐛 Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
da0bba89b16306f077026306f07702854ebd9916854ebd9916d113ed6d18View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.