GHSA-5qr2-v392-m9g8

Dashboard / Vulnerabilities / GHSA-5qr2-v392-m9g8

GHSA-5qr2-v392-m9g8

Summary: SWC HTML minifier may allow script element breakout when minifying embedded JSON

Details: ## Impact `@swc/html` minifies JSON contained in `script` elements such as `application/json` and `application/ld+json` by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as `\u003C` into literal `<` characters. If the JSON contained an escaped `</script>` sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed. Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page. ## Patches The issue is fixed in: - `@swc/html` 1.15.47 - `swc_html_minifier` 59.0.0 The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary. ## Workarounds Users who cannot upgrade can disable JSON minification with: ```js await minify(html, { minifyJson: false, });

References: https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8, https://nvd.nist.gov/vuln/detail/CVE-2026-72925, https://github.com/swc-project/swc/pull/12080, https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832, https://github.com/swc-project/swc, https://github.com/swc-project/swc/releases/tag/v1.15.47, https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1