Description
@swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value.
Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal < characters.
Recommendation
Update the @swc/html package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.15.47-nightly-20260729.1
- Patched version(s): 1.15.47-nightly-20260729.1
References
Could your website be exposed too?
SmartScanner can check your website for SWC HTML minifier may allow script element breakout when minifying embedded JSON and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed - CVE-2026-54606
- md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) - CVE-2026-46492
- ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, - CVE-2026-113650
- Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML - CVE-2026-118660
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026