GHSA-5qr2-v392-m9g8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5qr2-v392-m9g8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5qr2-v392-m9g8/GHSA-5qr2-v392-m9g8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-5qr2-v392-m9g8
- Aliases
- Published
- 2026-09-08T17:58:00Z
- Modified
- 2026-09-08T18:15:03Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- SWC HTML minifier may allow script element breakout when minifying embedded JSON
- Details
-
Impact
@swc/htmlminifies JSON contained inscriptelements such asapplication/jsonandapplication/ld+jsonby parsing and serializing the JSON value.Before the patched versions, JSON serialization could convert escaped less-than signs such as
\u003Cinto literal<characters. If the JSON contained an escaped</script>sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.
Patches
The issue is fixed in:
@swc/html1.15.47swc_html_minifier59.0.0
The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.
Workarounds
Users who cannot upgrade can disable JSON minification with:
await minify(html, { minifyJson: false, }); - Database specific
{ "cwe_ids": [ "CWE-116", "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-09-08T17:58:00Z", "nvd_published_at": "2026-08-11T15:17:38Z", "severity": "MODERATE" }- References
-
- https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8
- https://nvd.nist.gov/vuln/detail/CVE-2026-72925
- https://github.com/swc-project/swc/pull/12080
- https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832
- https://github.com/swc-project/swc
- https://github.com/swc-project/swc/releases/tag/v1.15.47
- https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1
Affected packages
npm / @swc/html
Package
- Name
- @swc/html
- View open source insights on deps.dev
- Purl
- pkg:npm/%40swc/html
crates.io / swc_html_minifier
Package
- Name
- swc_html_minifier
- View open source insights on deps.dev
- Purl
- pkg:cargo/swc_html_minifier