CVE-2026-72925 is a mutation XSS (mXSS) in SWC's JSON minification when that JSON lives inside HTML script elements. The attack doesn't require an attacker who already controls JSON content directly — that's a red herring in the CVE description. The actual threat model is: JSON passes through SWC's parser, which normalizes it into an intermediate tree (where </script> is just a string value, syntactically valid and semantically invisible), then SWC re-serializes that normalized form without re-applying HTML escaping for the script context. The closing tag that was safely encoded in the original raw HTML suddenly becomes a real HTML tag in the output, breaking out of the <script type="application/json"> container.
The attack surface is data that survives JSON parsing but wasn't sanitized for the HTML script context — content from external APIs, user uploads, database fields, or transitive dependencies that passed through HTML-aware sanitization at one stage but not at the re-serialization stage. An attacker who can't inject <script> directly might inject </script><script>alert(1)// into a JSON field that eventually gets minified by SWC and lands in a build artifact.
The fix — escape_json_for_html_script — is the right mitigation. It escapes < characters during JSON serialization specifically when the output context is an HTML script element. This is more surgical than attempting to sanitize at parse time, which would be application-dependent and fragile.
The critical detail that matters for prioritization: the fix shipped in nightly builds. Stable releases remain vulnerable, and most production build pipelines explicitly do not run nightly versions. This means the CVE-to-fix metric is technically satisfied but practically misleading — the remediation gap for production systems is substantial. You should audit your build pipeline to determine whether any JSON content originates from external sources before SWC processes it, and treat any untrusted JSON-in-script in build output as potentially exploitable until you're on a stable release that includes the HTML-context escaping.