low
—
GHSA-hwmc-r6mf-jh83 json
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
published 4mo ago modified 2mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.
Patch / fix
- packagist spatie/schema-org 3.23.2, 4.0.2
- github.com/spatie/schema-org@be389b4 commit
- github.com/spatie/schema-org#242 pull request
- github.com/spatie/schema-org/releases/tag/4.0.2 release
Is GHSA-hwmc-r6mf-jh83 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | spatie/schema-org | >=3.23.1, <3.23.2 >=4.0.0, <4.0.2 |
3.23.2 4.0.2 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/spatie/schema-org/pull/242
web
-
github.com
/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml
web
-
github.com
/spatie/schema-org
package
-
github.com
/spatie/schema-org/releases/tag/4.0.2
web
Sources
- GitHub Advisory GHSA-hwmc-r6mf-jh83
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.