{"id":"GHSA-hwmc-r6mf-jh83","title":"Schema.org has cross-site scripting (XSS) via script break-out in toScript() output","summary":"Schema.org has cross-site scripting (XSS) via script break-out in toScript() output","severity":"low","cwe":["CWE-79"],"vendor":"spatie","product":"spatie/schema-org","ecosystem":"composer","affected":["spatie/schema-org >= 3.23.1, < 3.23.2","spatie/schema-org >= 4.0.0, < 4.0.2"],"patched":["spatie/schema-org 3.23.2","spatie/schema-org 4.0.2"],"published":"2026-07-01","updated":"2026-07-01","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-hwmc-r6mf-jh83","references":[{"url":"https://github.com/spatie/schema-org/pull/242"},{"url":"https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml"},{"url":"https://github.com/spatie/schema-org/releases/tag/4.0.2"},{"url":"https://github.com/advisories/GHSA-hwmc-r6mf-jh83"}],"tags":["ghsa","composer"],"ingestedAt":"2026-07-01T19:15:59.918Z","slug":"GHSA-hwmc-r6mf-jh83","body":"## Overview\n\nSchema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.\n\n## Affected packages\n\n- `spatie/schema-org >= 3.23.1, < 3.23.2`\n- `spatie/schema-org >= 4.0.0, < 4.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `spatie/schema-org 3.23.2`\n- `spatie/schema-org 4.0.2`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}