AIKIDO-2026-11134

TL;DR

The default spree_storefront theme builds JSON-LD structured data in inline <script type="application/ld+json"> blocks using .to_json.html_safe without escaping angle brackets and ampersands, while spree_api disables ActiveSupport JSON HTML-entity escaping globally. Attacker-controlled product, post, or store fields embedded in those blocks can inject a literal </script> sequence and break out into executable HTML. The injected script then runs in the browser of visitors who load pages containing the affected JSON-LD markup. The fix centralizes JSON-LD output in a json_ld_script helper that serializes through ERB::Util.json_escape before rendering the script tag.