CVE-2026-72925: SWC HTML Minifier XSS Vulnerability

CVE-2026-72925 Overview

CVE-2026-72925 is a Cross-Site Scripting (XSS) vulnerability in SWC, a TypeScript and JavaScript compiler written in Rust. The flaw resides in the HTML minifier component, specifically in the handling of application/json and application/ld+json script elements. The minifyJson routine in crates/swc_html_minifier/src/lib.rs parsed and re-serialized attacker-controlled JSON without re-escaping less-than characters. An attacker who controls JSON embedded in a page can inject a closing </script> sequence to terminate the script element early and execute arbitrary JavaScript in the page origin. The issue is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attacker-controlled JSON data in structured data or configuration script blocks can break out of the containing <script> element and execute JavaScript in the victim site's origin after HTML minification.

Affected Products

@swc/html versions prior to 1.15.47-nightly-20260729.1
swc_html_minifier crate versions prior to 59.0.0
Web applications and static sites using SWC HTML minification with untrusted JSON script content

Discovery Timeline

2026-08-11 - CVE-2026-72925 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72925

Vulnerability Analysis

The SWC HTML minifier optimizes HTML documents, including inline JSON contained within <script type="application/json"> and <script type="application/ld+json"> elements. During minification, the tool parses the JSON payload and re-serializes it. The re-serialization step did not account for HTML tokenization rules that treat </script as a script-element boundary before JSON parsing occurs. As a result, JSON strings containing < characters were emitted as literal < in the output HTML rather than escaped as \\u003C. An attacker who influences JSON data embedded in a minified page can inject a closing script tag followed by arbitrary markup or JavaScript, achieving script execution in the origin of the generated page.

Root Cause

The root cause is missing HTML-context-aware escaping in the JSON serialization path of crates/swc_html_minifier/src/lib.rs. HTML tokenization recognizes </script before any JSON parser interprets the content. Because SWC did not re-escape < characters when writing JSON back into an HTML <script> element, structural HTML boundaries could be forged from within valid JSON string values.

Attack Vector

Exploitation requires that attacker-controlled JSON be included in a page that is later minified by a vulnerable version of @swc/html or swc_html_minifier. Typical scenarios include user-generated content serialized into JSON-LD structured data, product metadata in e-commerce pages, or configuration blobs hydrated from external sources. A victim then loads the minified page, at which point the injected script executes in the site's origin, enabling session theft, DOM manipulation, or credential harvesting. User interaction (visiting the page) is required, and the impact crosses a trust boundary from the JSON data source to the page origin.

rust

// Security patch from swc_html_minifier/src/lib.rs
// Source: https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832
         result.ok()
     }
 
+    /// Escapes serialized JSON so it cannot terminate its containing HTML
+    /// `script` element.
+    ///
+    /// HTML tokenization recognizes `</script` before the JSON is parsed.
+    /// Serializing an escaped `<` as a literal character can therefore turn
+    /// JSON data into a different HTML element structure.
+    fn escape_json_for_html_script(json: String) -> String {
+        if json.contains('<') {
+            json.replace('<', "\\\u003C")
+        } else {
+            json
+        }
+    }
+
     fn need_minify_js(&self) -> bool {
         match self.options.minify_js {
             MinifyJsOption::Bool(value) => value,

The patch introduces escape_json_for_html_script, which replaces every < in serialized JSON with the Unicode escape \\u003C. This preserves JSON semantics while preventing HTML tokenization from interpreting the sequence as a tag boundary.

Detection Methods for CVE-2026-72925

Indicators of Compromise

Minified HTML output containing literal </script> sequences inside <script type="application/json"> or <script type="application/ld+json"> blocks.
Unexpected inline scripts or event handlers appearing after JSON script elements in build artifacts.
Client-side runtime errors indicating JSON parse failures on pages that previously validated correctly.

Detection Strategies

Audit build pipelines for use of @swc/html below 1.15.47-nightly-20260729.1 or swc_html_minifier below 59.0.0 via lockfile inspection (package-lock.json, yarn.lock, Cargo.lock).
Add CI checks that scan minified HTML for < characters inside JSON script element bodies and fail the build when found.
Use Content Security Policy (CSP) violation reports to identify unexpected inline script execution originating from JSON-LD blocks.

Monitoring Recommendations

Monitor web analytics and error telemetry for CSP script-src violations tied to structured data blocks.
Track dependency updates for SWC-related packages across all frontend and static site generator projects.
Review server logs for anomalous JSON payloads containing </script substrings submitted by users or fetched from third-party APIs.

How to Mitigate CVE-2026-72925

Immediate Actions Required

Upgrade @swc/html to 1.15.47-nightly-20260729.1 or later, and swc_html_minifier to 59.0.0 or later.
Rebuild and redeploy all static assets and server-rendered pages produced by vulnerable SWC versions.
Inventory applications that embed untrusted JSON in application/json or application/ld+json script elements and prioritize their remediation.

Patch Information

The fix is committed in swc-project/swc commit e1877b4 and delivered through Pull Request #12080. Release notes are available in the SWC v1.15.47 release and the nightly release. Full details are documented in the GitHub Security Advisory GHSA-5qr2-v392-m9g8.

Workarounds

Pre-sanitize JSON payloads by replacing < with \\u003C before passing them to the SWC HTML minifier.
Disable HTML minification of application/json and application/ld+json script blocks until upgrading is possible.
Enforce a strict Content Security Policy that disallows inline scripts beyond a nonce-approved allowlist to limit exploit impact.

bash

# Upgrade @swc/html via npm
npm install @swc/html@1.15.47-nightly-20260729.1

# Upgrade swc_html_minifier via Cargo
cargo update -p swc_html_minifier --precise 59.0.0

# Verify installed versions
npm list @swc/html
cargo tree -p swc_html_minifier