Packagist/spatie/schema-org: low
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
Action: Upgrade spatie/schema-org to 3.23.2 or later.
composer require spatie/schema-org:3.23.2composer require spatie/schema-org:4.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.23.1 | 3.23.2 | - |
| 4.0.0 | 4.0.2 | - |
Fixed versions
| 3.23.2 | 4.0.2 |
Sources
- osv: GHSA-hwmc-r6mf-jh83
- https://github.com/spatie/schema-org/pull/242
- https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88
- https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml
- https://github.com/spatie/schema-org
- https://github.com/spatie/schema-org/releases/tag/4.0.2
published · modified · JSON