Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 1.3, published 1 July 2026.

Which products and versions are affected?

Spatie Schema-Org >= 3.23.1, < 3.23.2.

Is there a fix for This vulnerability?

A patch was published on 2026-04-20: Fix merged in PR #242 and released in version 4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Spatie Schema-Org at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Spatie schema-org XSS via script break-out in toScript

Q: Is there a fix for This vulnerability?

A patch was published on 2026-04-20: Fix merged in PR #242 and released in version 4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Spatie Schema-Org at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 1.3 · Published 2026-07-01

A vulnerability in the spatie/schema-org library, which is used to generate structured data for search engines, could allow attackers to inject malicious scripts into web pages. If an application uses this library to display user-provided information, an attacker could bypass security controls to execute code in a visitor's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Vendors: Spatie.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 1.3, published 1 July 2026.
Which products and versions are affected?: Spatie Schema-Org >= 3.23.1, < 3.23.2.
Is there a fix for This vulnerability?: A patch was published on 2026-04-20: Fix merged in PR #242 and released in version 4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Spatie Schema-Org at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-site scripting (XSS) vulnerability exists in spatie/schema-org due to improper neutralization of HTML tags in the toScript() output. The issue was introduced in version 3.23.1 when the JSON_UNESCAPED_SLASHES flag was added, which prevented the backslash-escaping of forward slashes. An attacker can provide a property value containing a closing script tag (</script>) to break out of the JSON-LD block and inject arbitrary HTML or JavaScript. The fix involves adding the JSON_HEX_TAG flag to json_encode, ensuring that '<' and '>' characters are serialized as Unicode escapes (\u003C and \u003E). Patches are available in versions 3.23.2 and 4.0.2.

Affected products

spatie schema-org >= 3.23.1, < 3.23.2
spatie schema-org >= 4.0.0, < 4.0.2

Timeline

2026-04-20: patched: Fix merged in PR #242 and released in version 4.0.2
2026-07-01: advisory: GitHub Advisory GHSA-hwmc-r6mf-jh83 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.