CVE-2026-54893: swoosh >= 1.12.0, < 1.26.3

CVE-2026-54893 affects swoosh. EPSS 0.00203 (percentile 0.09708), scored 20-Oct-2026. Affected range: >= 1.12.0, < 1.26.3. Fixed version: 1.26.3.

Affected technology

swoosh · >= 1.12.0, < 1.26.3
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

An attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and query string.

Published 21-Oct-2026 05:33 UTC

Product: swoosh
CCR priority: 0.1 /100 (P5)
EPSS: 0.00203 · percentile 0.09708 · 2026-10-20
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-21 04:17:24.410927+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-54893.html