GitHub Advisoryadvisory · Packagist
GHSA-hwmc-r6mf-jh83 Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
LOW
Official page ↗
- Ecosystem
- Packagist
- Packages
- spatie/schema-org
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
- Weaknesses
- CWE-79
- Reviewed
- 2026-07-01
Affected packages
• Packagist spatie/schema-org: >= 3.23.1, < 3.23.2 → fixed in 3.23.2
• Packagist spatie/schema-org: >= 4.0.0, < 4.0.2 → fixed in 4.0.2
Description
Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/spatie/schema-org/pull/242 web
- https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml web
- https://github.com/spatie/schema-org package
- https://github.com/spatie/schema-org/releases/tag/4.0.2 web