GHSA-hwmc-r6mf-jh83
GHSA-hwmc-r6mf-jh83 · Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.
CVSS 5.3 · Medium · Fix available
- Published
- Updated
Stack: php
Affected products and versions
spatie/schema-org Packagist
- Versions
- 3.23.1
- Affected ranges
- ECOSYSTEM: ≥ 3.23.1, < 3.23.2
Update to 3.23.2
spatie/schema-org Packagist
- Versions
- 4.0.0
- 4.0.1
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.0.2
Update to 4.0.2
Original sources
- https://github.com/spatie/schema-org/pull/242
- https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88
- https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml
- https://github.com/spatie/schema-org
- https://github.com/spatie/schema-org/releases/tag/4.0.2
- https://osv.dev/vulnerability/GHSA-hwmc-r6mf-jh83