# Spatie schema-org XSS via script break-out in toScript

Source: https://junglewise.ai/threats/spatie-schema-org-xss-via-script-break-out-in-toscript-05285833  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

Severity: low · CVSS 1.3 · Published 2026-07-01

A vulnerability in the spatie/schema-org library, which is used to generate structured data for search engines, could allow attackers to inject malicious scripts into web pages. If an application uses this library to display user-provided information, an attacker could bypass security controls to execute code in a visitor's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Vendors: [Spatie](https://junglewise.ai/threats/vendors/spatie).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 1.3, published 1 July 2026.

**Which products and versions are affected?** Spatie Schema-Org >= 3.23.1, < 3.23.2.

**Is there a fix for This vulnerability?** A patch was published on 2026-04-20: Fix merged in PR #242 and released in version 4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Spatie Schema-Org at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site scripting (XSS) vulnerability exists in spatie/schema-org due to improper neutralization of HTML tags in the toScript() output. The issue was introduced in version 3.23.1 when the JSON_UNESCAPED_SLASHES flag was added, which prevented the backslash-escaping of forward slashes. An attacker can provide a property value containing a closing script tag (</script>) to break out of the JSON-LD block and inject arbitrary HTML or JavaScript. The fix involves adding the JSON_HEX_TAG flag to json_encode, ensuring that '<' and '>' characters are serialized as Unicode escapes (\u003C and \u003E). Patches are available in versions 3.23.2 and 4.0.2.

## Affected products

- spatie schema-org >= 3.23.1, < 3.23.2
- spatie schema-org >= 4.0.0, < 4.0.2

## Timeline

- 2026-04-20: patched: Fix merged in PR #242 and released in version 4.0.2
- 2026-07-01: advisory: GitHub Advisory GHSA-hwmc-r6mf-jh83 published

## References

- [https://github.com/spatie/schema-org/pull/242](https://github.com/spatie/schema-org/pull/242)
- [https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88](https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88)
- [https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml](https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml)
- [https://github.com/spatie/schema-org/releases/tag/4.0.2](https://github.com/spatie/schema-org/releases/tag/4.0.2)