{"id":"CVE-2026-72925","state":"PUBLISHED","title":"SWC HTML minifier may allow script element breakout when minifying embedded JSON","description":"SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.","publishedAt":"2026-08-11T14:45:12.907Z","updatedAt":"2026-08-11T18:26:38.644Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["swc-project swc","@swc html","swc-project swc_html_minifier"],"affected":[{"vendor":"swc-project","product":"swc","versions":[{"version":"< 1.15.47","status":"affected"}]},{"vendor":"@swc","product":"html","versions":[{"version":"< 1.15.47-nightly-20260729.1","status":"affected"}]},{"vendor":"swc-project","product":"swc_html_minifier","versions":[{"version":"< 59.0.0","status":"affected"}]}],"references":["https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8","https://github.com/swc-project/swc/pull/12080","https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832","https://github.com/swc-project/swc/releases/tag/v1.15.47","https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1"],"weaknesses":["CWE-79","CWE-116"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72925.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72925","state":"PUBLISHED","datePublished":"2026-08-11T14:45:12.907Z","dateUpdated":"2026-08-11T18:26:38.644Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-08-10T17:57:26.144Z"},"containers":{"cna":{"title":"SWC HTML minifier may allow script element breakout when minifying embedded JSON","descriptions":[{"lang":"en","value":"SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0."}],"affected":[{"vendor":"swc-project","product":"swc","versions":[{"version":"< 1.15.47","status":"affected"}]},{"vendor":"@swc","product":"html","versions":[{"version":"< 1.15.47-nightly-20260729.1","status":"affected"}]},{"vendor":"swc-project","product":"swc_html_minifier","versions":[{"version":"< 59.0.0","status":"affected"}]}],"references":[{"url":"https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8","name":"https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/swc-project/swc/pull/12080","name":"https://github.com/swc-project/swc/pull/12080","tags":["x_refsource_MISC"]},{"url":"https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832","name":"https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832","tags":["x_refsource_MISC"]},{"url":"https://github.com/swc-project/swc/releases/tag/v1.15.47","name":"https://github.com/swc-project/swc/releases/tag/v1.15.47","tags":["x_refsource_MISC"]},{"url":"https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1","name":"https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-116","lang":"en","description":"CWE-116: Improper Encoding or Escaping of Output","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-08-11T14:45:12.907Z"},"source":{"advisory":"GHSA-5qr2-v392-m9g8","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-11T18:26:27.962954Z","id":"CVE-2026-72925","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-11T18:26:38.644Z"}}]}}}