AIKIDO-2026-84516

TL;DR

The minifier automatically processes the contents of JSON script elements such as application/json and application/ld+json by round-tripping them through JSON.parse() and JSON.stringify(). Because JSON.stringify() writes < and / literally, any \u003C escaping present in the source JSON is dropped from the output. A nested </script> sequence carried inside user-supplied JSON data can then terminate the containing script element early and inject live DOM, including a second executing script. The fix re-escapes < as \u003C after stringifying so encoded payloads can no longer break out of the script element.