AIKIDO-2026-362235

TL;DR

The JsonLd component renders structured data by serializing the schema with JSON.stringify and injecting the result into an inline <script type="application/ld+json"> block using {@html}. The < character in the serialized output is not escaped, so a schema value that contains a </script> sequence closes the JSON-LD script element and lets arbitrary markup be injected into the rendered page. When schema values include untrusted or user-controlled data, this leads to cross-site scripting in the server-rendered HTML. The fix escapes < as the JSON escape sequence \u003c before the serialized JSON-LD is written into the script tag.