EUVD-2026-56179Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requiring victim page load; no attacker auth needed; scope changes to victim browser origin; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
AnalysisAI
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions must be present: (1) the application uses swc_html_minifier or @swc/html to minify HTML at build time or per-request; (2) the HTML being minified contains at least one <script type='application/json'> or <script type='application/ld+json'> element whose content includes attacker-influenced data with a < character - typically data that was originally unicode-escaped as \u003C in JSON storage but gets unescaped during the parse/serialize cycle; and (3) a victim end user must load or navigate to the page containing the malicious minified output (CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is consistent with a classic reflected or stored XSS with cross-origin scope change: modest per-instance confidentiality and integrity impact but no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a user profile field or API parameter containing the value \u003C/script>\u003Cscript>alert(document.cookie)\u003C/script> - a valid unicode-escaped string in JSON. The application stores this and later renders it into a <script type='application/json'> block in a server-generated page. … |
| Remediation | Upgrade @swc/html to version 1.15.47-nightly-20260729.1 or later and swc_html_minifier to version 59.0.0 or later; these are the vendor-confirmed fixed releases documented at https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1 and the security advisory GHSA-5qr2-v392-m9g8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today