npm/@swc/html CVE-2026-72925: medium 6.1, EPSS 0.34%

SWC HTML minifier may allow script element breakout when minifying embedded JSON

Action: Upgrade @swc/html to 1.15.47-nightly-20260729.1 or later.

npm i @swc/html@1.15.47-nightly-20260729.1

Affected

Fixed versions

Sources

• osv: GHSA-5qr2-v392-m9g8
• https://github.com/swc-project/swc/security/advisories/GHSA-5qr2-v392-m9g8
• https://nvd.nist.gov/vuln/detail/CVE-2026-72925
• https://github.com/swc-project/swc/pull/12080
• https://github.com/swc-project/swc/commit/e1877b44bdac8abc9fd51e984d584f40f6999832
• https://github.com/swc-project/swc
• https://github.com/swc-project/swc/releases/tag/v1.15.47
• https://github.com/swc-project/swc/releases/tag/v1.15.47-nightly-20260729.1

CVE-2026-72925 · published 2026-09-08T17:58:00Z · modified 2026-09-08T18:15:03.995774389Z · JSON