GHSA-5qr2-v392-m9g8

## Impact

`@swc/html` minifies JSON contained in `script` elements such as `application/json` and `application/ld+json` by parsing and serializing the JSON value.

Before the patched versions, JSON serialization could convert escaped less-than signs such as `\u003C` into literal `<` characters. If the JSON contained an escaped `</script>` sequence, the generated HTML could terminate the containing script element early because HTML tokenization occurs before the JSON is consumed.

Applications that minify HTML containing attacker-controlled JSON data could therefore transform inert data into active markup. A crafted payload could execute script in the origin of the generated page.

## Patches

The issue is fixed in:

- `@swc/html` 1.15.47 - `swc_html_minifier` 59.0.0

The minifier now re-escapes less-than signs after JSON serialization, preserving the script element boundary.

## Workarounds

Users who cannot upgrade can disable JSON minification with:

```js await minify(html, { minifyJson: false, });