GHSA-5qr2-v392-m9g8 SWC HTML minifier may allow script element breakout when minifying embedded JSON

• npm @swc/html: < 1.15.47-nightly-20260729.1 → fixed in 1.15.47-nightly-20260729.1 • crates.io swc_html_minifier: < 59.0.0 → fixed in 59.0.0

Impact `@swc/html` minifies JSON contained in `script` elements such as `application/json` and `application/ld+json` by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as `\u003C` into literal `` sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed. Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page. Patches The issue is fixed in: • `@swc/html` 1.15.47 • `swc_html_minifier` 59.0.0 The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary. Workarounds Users who cannot upgrade can disable JSON minification with: ```js await minify(html, { minifyJson: false, });