CVE-2026-72925

Name of the Vulnerable Software and Affected Versions @swc/html versions prior to 1.15.47-nightly-20260729.1 swc html minifier versions prior to 59.0.0

Description The minifyJson processing in crates/swc html minifier/src/lib.rs fails to implement the escape json for html script behavior when parsing and serializing attacker-controlled JSON within application/json and application/ld+json script elements. This lack of re-escaping for less-than signs allows a closing script sequence to terminate the element prematurely, enabling the execution of arbitrary scripts within the origin of the generated page.

Recommendations Update @swc/html to version 1.15.47-nightly-20260729.1 or later. Update swc html minifier to version 59.0.0 or later.