AIKIDO-2026-74136

TL;DR

The HTML minifier in swc_html_minifier compresses JSON embedded in script elements such as application/json and application/ld+json by parsing and re-serializing the JSON value. During serialization it can turn escaped less-than sequences like \u003C back into literal < characters, so a script-closing sequence inside the JSON can terminate the containing script element early because HTML tokenization runs before the JSON is consumed. When the minified HTML embeds user-controlled JSON data, inert data can become active markup and execute script in the origin of the generated page. The fix re-escapes less-than signs after JSON serialization so the script element boundary is preserved.