#497·monolith

monolith 2.10.1: Inlined <script> content isn't escaped for some embedded </script> sequences, corrupting output HTML

Author: jonschoningCreated Jul 27, 2026Updated Jul 27, 2026

monolith 2.10.1, run as:

bash
monolith -I -q -e -v -a -o out.html "https://openai.com/index/separating-signal-from-noise-coding-evaluations/"
monolith -I -q -e -v -a -f -F -i -o out-no-img.html "https://openai.com/index/separating-signal-from-noise-coding-eval
uations/"

The output HTML is corrupted: viewing it in a browser shows raw minified JavaScript as visible page text partway down the page, instead of it running as a script.

Image

Cause: one of the page's external scripts (a minified React DOM bundle) contains this JS string literal:

xml
  case"script":(a=o.createElement("div")).innerHTML="<script></script>",a=a.removeChild(a.firstChild);break;

That's a perfectly valid JS string literal inside the original external .js file. But monolith inlines the fetched script's raw bytes verbatim into an inline element in the output HTML. HTML parsers close a byte sequence they encounter, with no awareness of JS string/quote context, so this embedded inside the string literal prematurely terminates monolith's wrapper sequences elsewhere, so something in the pipeline handles this correctly in some cases, but there are a few chunks passed through unescaped.

Expected: when inlining an external script's contents into an inline

Repro URL: https://openai.com/index/separating-signal-from-noise-coding-evaluations/