JSON Parsing Vulnerability in SWC HTML Compiler by SWC Project

CVE-2026-72925

What is CVE-2026-72925?

The SWC HTML compiler, built using Rust, has a vulnerability that allows for unsafe parsing and serialization of JSON content within application/json and application/ld+json script elements. This occurs due to the lack of the escape_json_for_html_script functionality that is designed to re-escape less-than signs. Consequently, an attacker can exploit this vulnerability to prematurely terminate the script element, potentially running malicious scripts in the context of the page's origin. This issue has been addressed in versions @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.

References