DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72925: CVE-2026-72925: Cross-Site Scripting via Improper JSON Escaping in SWC HTML Minifier

#security #cve #cybersecurity

CVE-2026-72925: Cross-Site Scripting via Improper JSON Escaping in SWC HTML Minifier

Vulnerability ID: CVE-2026-72925
CVSS Score: 6.1
Published: 2026-09-08

CVE-2026-72925 is a critical vulnerability in the SWC HTML minifier (@swc/html and swc_html_minifier) where safe Unicode-escaped characters in embedded JSON script tags are normalized into raw, unescaped characters during optimization, causing browser-side HTML injection and Cross-Site Scripting.

TL;DR

SWC HTML minifier incorrectly converts safe Unicode-escaped less-than characters inside JSON blocks to raw less-than characters, allowing attackers to terminate script blocks early and execute arbitrary JavaScript (XSS) in victim browsers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79 (Improper Neutralization of Input During Web Page Generation)
  • Attack Vector: Network (AV:N/AC:L/PR:N/UI:R)
  • CVSS v3.1 Score: 6.1 (Medium)
  • EPSS Score: 0.00194 (Percentile: 9.11%)
  • Impact: Stored / DOM-based Cross-Site Scripting (XSS)
  • Exploit Status: Conceptual Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • @swc/html
  • swc
  • swc_html_minifier
  • @swc/html: < 1.15.47 (Fixed in: 1.15.47)
  • swc: < 1.15.47 (Fixed in: 1.15.47)
  • swc_html_minifier: < 59.0.0 (Fixed in: 59.0.0)

Code Analysis

Commit: e1877b4

fix(html/minifier): Escape < character when serializing script with JSON MIME type

Mitigation Strategies

  • Upgrade '@swc/html' npm dependency to 1.15.47 or later.
  • Upgrade 'swc' rust crate to 1.15.47 or later, and 'swc_html_minifier' to 59.0.0 or later.
  • Implement automated dependency checks (e.g., npm audit, Dependabot) in CI/CD pipelines to flag vulnerable SWC packages.
  • Deploy Web Application Firewall (WAF) rules to detect and filter out closing script tags within submitted JSON request payloads.

Remediation Steps:

  1. Identify applications in the portfolio utilizing '@swc/html' or 'swc_html_minifier' in their build configurations.
  2. Execute dependency updates to move package versions to 1.15.47 (npm) / 59.0.0 (crate) or higher.
  3. Rebuild static and dynamically served assets to overwrite previously compiled and serialized JSON artifacts.
  4. Perform manual verification using the test payload sequence in local test environments to ensure proper character escaping.

References

Read the full report for CVE-2026-72925 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)