{"action":"Upgrade spatie/schema-org to 3.23.2 or later.","affected":[{"fixed":"3.23.2","introduced":"3.23.1"},{"fixed":"4.0.2","introduced":"4.0.0"}],"component":"spatie/schema-org","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["3.23.2","4.0.2"],"ghsa_id":"GHSA-hwmc-r6mf-jh83","id":"tcs_01M5KF3ZF5RBYK092XYPWPTVZB","modified_at":"2026-09-10T03:50:12.332537462Z","published_at":"2026-07-01T18:32:31Z","references":["https://osv.dev/vulnerability/GHSA-hwmc-r6mf-jh83","https://github.com/spatie/schema-org/pull/242","https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88","https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml","https://github.com/spatie/schema-org","https://github.com/spatie/schema-org/releases/tag/4.0.2"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-hwmc-r6mf-jh83","url":"https://osv.dev/vulnerability/GHSA-hwmc-r6mf-jh83"}],"summary":"Schema.org has cross-site scripting (XSS) via script break-out in toScript() output"}