{"id":"GHSA-hwmc-r6mf-jh83","aliases":[],"status":"published","title":"Schema.org has cross-site scripting (XSS) via script break-out in toScript() output","description":"Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.","severity":{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-07-01T18:32:31Z","modified":"2026-09-10T03:50:12Z","fixes":[{"ecosystem":"Packagist","package":"spatie/schema-org","fixed_in":["3.23.2","4.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"spatie/schema-org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.1"},{"fixed":"3.23.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"spatie/schema-org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"spatie/schema-org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.1"},{"fixed":"3.23.2"}]}],"versions":["3.23.1"]},{"source":"osv","ecosystem":"Packagist","package":"spatie/schema-org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}],"versions":["4.0.0","4.0.1"]}],"references":[{"url":"https://github.com/spatie/schema-org/pull/242","tags":["web"]},{"url":"https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml","tags":["web"]},{"url":"https://github.com/spatie/schema-org/releases/tag/4.0.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hwmc-r6mf-jh83"},{"url":"https://github.com/spatie/schema-org","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hwmc-r6mf-jh83","title":"Schema.org has cross-site scripting (XSS) via script break-out in toScript() output","description":"Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.","status":"published","published":"2026-07-01T18:32:31Z","modified":"2026-07-01T18:33:05Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:36.577366Z"}],"osv":[{"id":"GHSA-hwmc-r6mf-jh83","title":"Schema.org has cross-site scripting (XSS) via script break-out in toScript() output","description":"Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.","status":"published","published":"2026-07-01T18:32:31Z","modified":"2026-09-10T03:50:12.332537462Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}