What is GHSA-hwmc-r6mf-jh83?

GHSA-hwmc-r6mf-jh83 is a security advisory published by GitHub Security Advisories with Low severity. Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

Why does GHSA-hwmc-r6mf-jh83 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-hwmc-r6mf-jh83?

GHSA-hwmc-r6mf-jh83 affects 2 products, including: composer/spatie/schema-org:\u003e= 3.23.1, \u003c 3.23.2; composer/spatie/schema-org:\u003e= 4.0.0, \u003c 4.0.2.

GHSA-hwmc-r6mf-jh83LowDisclosed before NVD

Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

Vendor

GitHub Security Advisories

Published

July 1, 2026

Last Modified

July 1, 2026

📋 Description

Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.

🎯 Affected products2

composer/spatie/schema-org:>= 3.23.1, < 3.23.2
composer/spatie/schema-org:>= 4.0.0, < 4.0.2

🔗 References (5)

https://github.com/spatie/schema-org/pull/242
https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88
https://github.com/FriendsOfPHP/security-advisories/blob/master/spatie/schema-org/2026-04-20.yaml
https://github.com/spatie/schema-org/releases/tag/4.0.2
https://github.com/advisories/GHSA-hwmc-r6mf-jh83