GHSA-5qr2-v392-m9g8: XSS
Impact
@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.
Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters. If the JSON contained an escaped </script> sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.
Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.
Patches
The issue is fixed in:
- @swc/html 1.15.47 - swchtmlminifier 59.0.0
The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.
Workarounds
Users who cannot upgrade can disable JSON minification with:
js await minify(html, { minifyJson: false, });
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/swc_html_minifierto a version that resolves this vulnerability.Fixed in 59.0.0 - Upgrade
Upgrade
npm/@swc/htmlto a version that resolves this vulnerability.Fixed in 1.15.47-nightly-20260729.1 - Upgrade
Upgrade
@swc/htmlto a version that resolves this vulnerability.Fixed in 1.15.47 - Upgrade
Upgrade
swc_html_minifierto a version that resolves this vulnerability.Fixed in 59.0.0 - Configuration
Disable JSON minification by setting `minifyJson: false` in the `@swc/html` `minify(html, { ... })` options.
@swc/html minifyJson = false
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed when they minify HTML containing attacker-controlled JSON inside script elements, including application/json or application/ld+json. The risk is that inert JSON data can be transformed into active markup in the generated page.
What must an attacker control to exploit the issue?
An attacker needs to influence JSON embedded in the HTML being minified and supply a crafted value containing an escaped </script> sequence. During JSON serialization, escaped less-than signs can become literal < characters, allowing the script element to be terminated early.
How can this be mitigated if an upgrade is not immediately possible?
Disable JSON minification by setting minifyJson: false in the minifier options. This prevents the vulnerable JSON parsing and serialization path from being used.
What versions contain the fix?
The issue is fixed in @swc/html 1.15.47 and swc_html_minifier 59.0.0. The fix re-escapes less-than signs after JSON serialization to preserve the script element boundary.