GHSA-hwmc-r6mf-jh83: Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

July 1, 2026

Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.

References

github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml
github.com/advisories/GHSA-hwmc-r6mf-jh83
github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88
github.com/spatie/schema-org/pull/242
github.com/spatie/schema-org/releases/tag/4.0.2

Code Behaviors & Features

Detect and mitigate GHSA-hwmc-r6mf-jh83 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →