1.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-hwmc-r6mf-jh83

GHSA-hwmc-r6mf-jh83: Schema.org has cross-site scripting (XSS) via script break-out in toScript() output

Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-hwmc-r6mf-jh83

GHSA-hwmc-r6mf-jh83:

1.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
spatie/schema-org	composer	>= 3.23.1, < 3.23.2	3.23.2
spatie/schema-org	composer	>= 4.0.0, < 4.0.2	4.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cross-site scripting (XSS) issue in the spatie/schema-org library. The root cause is the improper escaping of data when generating JSON-LD script tags. The toScript() method in the BaseType, Graph, and MultiTypedEntity classes uses json_encode to serialize schema data. However, prior to the patch, it did not use the JSON_HEX_TAG flag. This meant that characters like < and > were not escaped. An attacker could provide a malicious string, such as </script><script>alert(1)</script>, as a value for a schema property. When toScript() is called, this string would be rendered directly into the HTML, allowing the attacker to break out of the intended JSON-LD script block and execute arbitrary JavaScript in the context of the user's browser. The provided patch fixes this by adding the JSON_HEX_TAG flag to the json_encode calls, which ensures that < and > are converted to \u003C and \u003E, respectively, thus neutralizing the XSS vector.

Vulnerable functions

BaseType::toScript

src/BaseType.php

The `toScript` function in the `BaseType` class is vulnerable to XSS. It uses `json_encode` to serialize data into a `<script>` tag without escaping HTML tags. An attacker can inject a malicious string containing `</script>` to break out of the script block and execute arbitrary JavaScript. The patch adds the `JSON_HEX_TAG` flag to `json_encode` to mitigate this.

Graph::toScript

src/Graph.php

The `toScript` function in the `Graph` class is vulnerable to XSS. It uses `json_encode` to serialize data into a `<script>` tag without escaping HTML tags. An attacker can inject a malicious string containing `</script>` to break out of the script block and execute arbitrary JavaScript. The patch adds the `JSON_HEX_TAG` flag to `json_encode` to mitigate this.

MultiTypedEntity::toScript

src/MultiTypedEntity.php

The `toScript` function in the `MultiTypedEntity` class is vulnerable to XSS. It uses `json_encode` to serialize data into a `<script>` tag without escaping HTML tags. An attacker can inject a malicious string containing `</script>` to break out of the script block and execute arbitrary JavaScript. The patch adds the `JSON_HEX_TAG` flag to `json_encode` to mitigate this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.