The SWC HTML minifier fails to re‑escape less‑than characters when serializing JSON that resides inside <script> elements marked as application/json or application/ld+json. This omission allows an attacker to inject a closing </script> tag in the JSON payload, prematurely ending the element and causing the browser to execute arbitrary JavaScript in the page’s origin. The flaw is a classic cross‑site scripting weakness rooted in improper output encoding, identified as CWE‑116 and CWE‑79.

The vulnerability affects the open‑source packages @{swc}/html and swc-project's swc_html_minifier, both components of the SWC TypeScript/JavaScript compiler suite. Any installation that uses these crates prior to the advertised releases – @swc/html 1.15.47‑nightly‑20260729.1 and swc_html_minifier 59.0.0 – is susceptible. The fix is available in the referenced nightly release and tagged release of the library.

With a CVSS score of 6.1 the issue carries moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. Attack requires a web application that injects untrusted JSON into script tags and then minifies the resulting HTML with SWC. In the presence of such user‑controlled JSON, an attacker can trigger a script breakout and achieve client‑side code execution, but environments that never embed JSON in script elements or that sanitize the input evade exploitation.