Answer in brief
CVE-2026-72925 records a Unknown severity vulnerability in SWC HTML minifier may allow script element breakout when minifying embedded JSON. The current sources do not mark it as known exploited. The current feed maps @swc/html (generic), swc-project/swc (generic), swc-project/swc_html_minifier (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @swc/html (generic), swc-project/swc (generic), swc-project/swc_html_minifier (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @swc/htmlgeneric | < 1.15.47-nightly-20260729.1 | Not reported |
| swc-project/swcgeneric | < 1.15.47 | Not reported |
| swc-project/swc_html_minifiergeneric | < 59.0.0 | Not reported |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72925 records a Unknown severity vulnerability in SWC HTML minifier may allow script element breakout when minifying embedded JSON. The current sources do not mark it as known exploited. The current feed maps @swc/html (generic), swc-project/swc (generic), swc-project/swc_html_minifier (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @swc/html (generic), swc-project/swc (generic), swc-project/swc_html_minifier (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @swc/htmlgeneric | < 1.15.47-nightly-20260729.1 | Not reported |
| swc-project/swcgeneric | < 1.15.47 | Not reported |
| swc-project/swc_html_minifiergeneric | < 59.0.0 | Not reported |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 11, 2026
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
Quoted source text, attributed separately from HOL analysis.