Most recent entries from all

EUVD-2026-351216

fkie_cve-2026-72925

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.

GHSA-5qr2-v392-m9g8 — SWC HTML minifier may allow script element breakout when minifying embedded JSON

Affected: npm: @swc/html, crates.io: swc_html_minifier

## Impact

`@swc/html` minifies JSON contained in `script` elements such as `application/json` and `application/ld+json` by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as `\u003C` into literal `<` characters. If the JSON contained an escaped `</script>` sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

## Patches

The issue is fixed in:

- `@swc/html` 1.15.47 - `swc_html_minifier` 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

## Workarounds

Users who cannot upgrade can disable JSON minification with:

```js await minify(html, { minifyJson: false, });