Medium, CVSS 6.1npmAmendedPublished
SWC HTML minifier may allow script element breakout when minifying embedded JSON
CVE-2026-72925 · GHSA-5qr2-v392-m9g8
- Affected
- npm @swc/html < 1.15.47-nightly-20260729.1
- Fixed in
- 1.15.47-nightly-20260729.1· Vendor fix available
- Issue
- Impact @swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed. Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page. Patches The issue is fixed in: - @swc/html 1.15.47 - swchtmlminifier 59.0.0 The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary. Workarounds Users who cannot upgrade can disable JSON minification with: js await minify(html, { minifyJson: false, });
Recommended action: Upgrade to 1.15.47-nightly-20260729.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.