CVE-2026-72925 in swc
Summary
by MITRE • 08/11/2026
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability resides within the SWC HTML minifier component that processes JSON data within script elements, specifically targeting application/json and application/ld+json content types. This flaw exists in the minifyJson function located in crates/swc_html_minifier/src/lib.rs where the processor fails to properly escape less-than characters when handling attacker-controlled JSON input. The absence of escape_json_for_html_script behavior creates a critical security gap that allows malicious actors to inject HTML closing tags within JSON data, effectively terminating script elements prematurely and enabling arbitrary code execution within the context of the originating page.
The technical implementation flaw stems from inadequate input sanitization during the minification process, where JSON content is parsed and serialized without proper HTML escaping mechanisms. When the minifier encounters less-than characters in JSON data that are intended for script contexts, it fails to convert these characters into their HTML entity equivalents, creating an injection vector. This vulnerability directly maps to CWE-116, which addresses improper encoding or escaping of output, and specifically relates to CWE-79, concerning cross-site scripting vulnerabilities due to insufficient output escaping. The flaw operates at the intersection of data processing and HTML generation, where structured data flows into an HTML context without proper boundary enforcement.
The operational impact of this vulnerability is severe as it enables attackers to perform cross-site scripting attacks against users who encounter the malformed HTML output generated by the affected SWC versions. An attacker can craft malicious JSON payloads containing closing script tags that will be interpreted by browsers as actual HTML markup, leading to script execution in the context of the vulnerable web application. This allows for session hijacking, data theft, defacement, and other malicious activities that compromise user security and application integrity. The vulnerability affects any web application that utilizes SWC HTML minification for processing JSON content within HTML documents, particularly impacting sites using structured data formats like JSON-LD for search engine optimization.
Mitigation strategies should prioritize upgrading to the patched versions @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0 which implement proper JSON escaping behavior. Organizations should also consider implementing additional input validation layers that sanitize JSON content before processing, particularly for data originating from untrusted sources. The fix aligns with ATT&CK technique T1203, which involves bypassing security measures through code manipulation, by ensuring proper escaping of HTML-sensitive characters in processed content. Security teams should conduct comprehensive testing to verify that all JSON data within script elements is properly escaped and that the minification process maintains the integrity of HTML boundaries while preserving the functional correctness of the generated output.