Medium · 5.4 CVE-2022-33154 EUVD-2022-5898GHSA-374w-gwqr-fmxg

brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS

Published Jul 12, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Description

The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.

Ecosystem	Package	Affected	Fixed	Record
Packagist	brotkrueml/schema	>= 2.0.0, < 2.5.1	2.5.1	GHSA-374w-gwqr-fmxg
Packagist	brotkrueml/schema	< 1.13.1	1.13.1	GHSA-374w-gwqr-fmxg