CVE-2026-72925Medium· 6.1▾ SunlitSWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-contro…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@swc/html < 1.15.47-nightly-20260729.1swc_html_minifier < 59.0.0Patched in:
@swc/html 1.15.47-nightly-20260729.1swc_html_minifier 59.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12048Critical· 9.3Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths
CVE-2026-12047Low· 3.5HTML injection in pgAdmin 4's cloud deployment module
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-104252Critical· 9.8Vitess is a database clustering system for horizontal scaling of MySQL
CVE-2026-104250Medium· 6.1The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more
CVE-2026-106444Medium· 4.7Handlebars provides the power necessary to let users build semantic templates