Listen to this Post
The `spatie/schema-org` package provides a fluent builder for Schema.org types and an LD+JSON generator. Affected versions (≥3.23.1, <3.23.2 and ≥4.0.0, <4.0.2) are vulnerable to Cross‑Site Scripting (XSS) due to insufficient escaping in the `toScript()` output.
The `toScript()` method is used to generate JavaScript code that embeds structured data (typically as a JSON‑LD script block) directly into HTML pages. Under normal circumstances, user‑supplied values passed into Schema.org properties are rendered inside a `` tag (e.g., </script><img src=x onerror=alert(1)>). Because the output is not sanitised, the injected `` prematurely terminates the enclosing `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.