SWC HTML Minifier CVE-2026-72925

Three concurrent conditions must be present: (1) the application uses swc_html_minifier or @swc/html to minify HTML at build time or per-request; (2) the HTML being minified contains at least one <script type='application/json'> or <script type='application/ld+json'> element whose content includes attacker-influenced data with a < character - typically data that was originally unicode-escaped as \u003C in JSON storage but gets unescaped during the parse/serialize cycle; and (3) a victim end user must load or navigate to the page containing the malicious minified output (CVSS UI:R). Applications serving only static, developer-authored JSON in script blocks with no user-supplied values are not exposed. The CVSS PR:N metric confirms no attacker authentication is required against the target application, but the attacker must have a channel - form submission, API call, URL parameter, or indirect data injection - to influence the JSON content that the minifier processes.

The vendor-assigned CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is consistent with a classic reflected or stored XSS with cross-origin scope change: modest per-instance confidentiality and integrity impact but no availability impact. No EPSS data was provided; exploitation probability must be inferred from CVSS metrics alone. This vulnerability is not in the CISA KEV catalog at time of analysis, and no public exploit code has been identified. The real-world risk is conditional on deployment pattern: only applications that (1) actively use SWC's HTML minifier, (2) embed untrusted or attacker-influenced data inside JSON script blocks, and (3) serve the minified output to end users are exposed. Frameworks using SWC for SSR with dynamic structured-data injection (e.g., ld+json SEO blocks populated from user-controlled content) represent the highest-risk deployment scenario. The attack technique is trivially understood by any XSS researcher once the codepath is known, meaning dwell time between disclosure and exploitation attempts is likely short for affected applications.

An attacker submits a user profile field or API parameter containing the value \u003C/script>\u003Cscript>alert(document.cookie)\u003C/script> - a valid unicode-escaped string in JSON. The application stores this and later renders it into a <script type='application/json'> block in a server-generated page. When SWC HTML minifier processes the page, it parses the JSON (unescaping \u003C to literal <), then re-serializes and writes the result back to the DOM node without escaping, producing a literal </script><script>alert(document.cookie)</script> sequence in the output HTML. Any victim who loads the minified page triggers the injected script, which executes in the page's full origin context.