No access to your tenant or devices. Every item links to its source. What this means
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
Read the publisher's advisorySWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
Read the publisher's advisorySWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
Read the publisher's advisory## Impact `@swc/html` minifies JSON contained in `script` elements such as `application/json` and `application/ld+json` by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as `\u003C` into literal `<` characters. If the JSON contained an escaped `</script>` sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed. Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page. ## Patches The issue is fixed in: - `@swc/html` 1.15.47 - `swc_html_minifier` 59.0.0 The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary. ## Workarounds Users who cannot upgrade can disable JSON minification with: ```js await minify(html, { minifyJson: false, });
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "swc-project",
"product": "swc",
"versions": [
{
"version": "< 1.15.47",
"status": "affected"
}
]
}Vendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "@swc",
"product": "html",
"versions": [
{
"version": "< 1.15.47-nightly-20260729.1",
"status": "affected"
}
]
}Vendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "swc-project",
"product": "swc_html_minifier",
"versions": [
{
"version": "< 59.0.0",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
datePublished: Aug 11, 2026, 2:45:12 PM
dateUpdated: Aug 11, 2026, 6:26:38 PM
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Awaiting Analysis
Weakness classifications: CWE-79 · CWE-116
published: 2026-08-11T15:17:38.497
lastModified: 2026-09-18T20:05:53.723
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
npm
SEMVER · introduced 0 → fixed 1.15.47-nightly-20260729.1
crates.io
SEMVER · introduced 0 → fixed 59.0.0
Original source record · Cite this exact observation · Complete original publisher JSON