Swc Html Minifier
Monthly
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. No public exploit has been identified at time of analysis, but the attack technique is a well-understood HTML parser quirk and the fix commit provides a clear reproduction case.
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. No public exploit has been identified at time of analysis, but the attack technique is a well-understood HTML parser quirk and the fix commit provides a clear reproduction case.