AIKIDO-2026-751689
@swc/html is vulnerable to Cross-Site Scripting (XSS)
61
Medium Risk
This Affects:
@swc/htmlTL;DR
The HTML minifier in @swc/html compresses JSON embedded in script elements such as application/json and application/ld+json by parsing and re-serializing the JSON value. During serialization it can turn escaped less-than sequences like \u003C back into literal < characters, so a script-closing sequence inside the JSON can terminate the containing script element early because HTML tokenization runs before the JSON is consumed. When the minified HTML embeds user-controlled JSON data, inert data can become active markup and execute script in the origin of the generated page. The fix re-escapes less-than signs after JSON serialization so the script element boundary is preserved.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you minify HTML that embeds user-controlled JSON inside a script element such as application/json or application/ld+json.
Background info
@swc/html is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.5 - 1.15.46.
How to fix this
Upgrade the @swc/html library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant