Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M
CVE-2026-72925SWC HTML minifier may allow script element breakout when minifying embedded JSON
Medium 6.1
In plain English
A medium-severity cross-site scripting in html from @swc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @swc/html | 1.15.47-nightly-20260729.1 | GHSA-5qr2-v392-m9g8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| swc-project | swc | < 1.15.47 |
| @swc | html | < 1.15.47-nightly-20260729.1 |
| swc-project | swc_html_minifier | < 59.0.0 |
Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8 x_refsource_CONFIRM
- https://github.com/swc-project/swc/pull/12080 x_refsource_MISC
- https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832 x_refsource_MISC
- https://github.com/swc-project/swc/releases/tag/v1.15.47 x_refsource_MISC
- https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1 x_refsource_MISC