Executive brief
A vulnerability in the spatie/schema-org library, which is used to generate structured data for search engines, could allow attackers to inject malicious scripts into web pages. If an application uses this library to display user-provided information, an attacker could bypass security controls to execute code in a visitor's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in spatie/schema-org due to improper neutralization of HTML tags in the toScript() output. The issue was introduced in version 3.23.1 when the JSON_UNESCAPED_SLASHES flag was added, which prevented the backslash-escaping of forward slashes. An attacker can provide a property value containing a closing script tag (</script>) to break out of the JSON-LD block and inject arbitrary HTML or JavaScript. The fix involves adding the JSON_HEX_TAG flag to json_encode, ensuring that '<' and '>' characters are serialized as Unicode escapes (\u003C and \u003E). Patches are available in versions 3.23.2 and 4.0.2.
Affected products
- spatie schema-org >= 3.23.1, < 3.23.2
- spatie schema-org >= 4.0.0, < 4.0.2
Timeline
- 2026-04-20: patched: Fix merged in PR #242 and released in version 4.0.2
- 2026-07-01: advisory: GitHub Advisory GHSA-hwmc-r6mf-jh83 published