Executive brief
@swc/html is a popular tool for minifying HTML code used in web development workflows. A flaw in its JSON minification feature could allow attackers to inject executable JavaScript code by crafting specially formatted JSON data. When an application minifies HTML containing attacker-controlled JSON (such as embedded JSON datasets), the vulnerability could break out of script element boundaries and execute arbitrary code in users' browsers.
Technical details
The vulnerability is a Cross-Site Scripting (XSS) / output encoding flaw in @swc/html's JSON minification logic. When minifying JSON contained within script elements (application/json, application/ld+json), the minifier parses and re-serializes the JSON. However, the serialization step converts Unicode escape sequences like \u003C (escaped less-than sign) into literal < characters. Since HTML tokenization occurs before JSON parsing by the browser, an attacker can craft JSON containing the sequence \u003C/script\u003E which, after minification, becomes </script> and prematurely terminates the script element. This allows injection of sibling markup and scripts. The vulnerability requires user interaction (loading the minified page) but no authentication. Patches are available in @swc/html 1.15.47+ and swc_html_minifier 59.0.0+, which re-escape less-than signs after JSON serialization. Users unable to upgrade can disable JSON minification via the minifyJson option.
Affected products
- SWC Project @swc/html < 1.15.47-nightly-20260729.1
- SWC Project swc_html_minifier < 59.0.0
Timeline
- 2026-08-02: disclosed: Published by SWC project team
- 2026-08-02: patched: @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0 released
- 2026-09-08: advisory: GitHub Advisory GHSA-5qr2-v392-m9g8 and CVE-2026-72925 published