SWC HTML Minifier Vulnerability: Script Element Breakout Risk
- Severity
- HIGH
- Affected component
- @swc/html (npm)
- Affected versions
- < 1.15.47-nightly-20260729.1
- Patched version
- 1.15.47
An early warning has been issued regarding a potential vulnerability in the @swc/html npm package that may allow script element breakout when minifying embedded JSON. This could potentially transform inert data into active markup.
What happened
An early warning has been issued for a potential vulnerability in the @swc/html npm package. The issue reportedly allows script element breakout when minifying embedded JSON, which could transform inert data into active markup. This could allow a crafted payload to execute script in the origin of the generated page. The vulnerability is under investigation and has not yet been confirmed as exploited in the wild.
The affected components include @swc/html (npm) for versions less than 1.15.47-nightly-20260729.1 and swc_html_minifier (npm) for versions less than 59.0.0. The recommended patched versions are @swc/html@1.15.47 and swc_html_minifier@59.0.0. If upgrading is not possible, it is recommended to disable JSON minification.
What to do about it
- Upgrade to @swc/html@1.15.47 or swc_html_minifier@59.0.0.
- If upgrading is not possible, disable JSON minification.
- Monitor the primary sources for updates on the vulnerability.
How 0Day would have caught this
@swc/html is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using @swc/html (npm) for versions less than 1.15.47-nightly-20260729.1 or swc_html_minifier (npm) for versions less than 59.0.0.
What should I do right now?
Upgrade to @swc/html@1.15.47 or swc_html_minifier@59.0.0. If upgrading is not possible, disable JSON minification.
What is the current status of this vulnerability?
This is an early warning and the vulnerability is under investigation. It has not yet been confirmed as exploited in the wild.