The vulnerability exists in the minifyJson processing of the swc_html_minifier crate used by the swc-project. Prior to version 59.0.0, the component parses and serializes attacker-controlled JSON in application/json and application/ld+json script elements without applying the escape_json_for_html_script behavior. This omission allows less-than signs to remain unescaped, enabling a closing script sequence to terminate the script element prematurely and execute arbitrary script in the context of the generated page. The issue is addressed by properly escaping JSON content in swc_html_minifier 59.0.0 and later.

An attacker can exploit this vulnerability to inject and execute arbitrary scripts in the origin of the affected web page, potentially leading to information disclosure or manipulation of the page content. The CVSS 3.1 base score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

A fix is available in swc_html_minifier version 59.0.0. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.