AIKIDO-2026-507054

TL;DR

The jekyll-seo-tag Liquid template puts several metadata fields - author name, author Twitter handle, canonical URL, page locale, image alt, height and width, and the Twitter card type - into HTML attributes without escaping, and serializes the JSON-LD block with jsonify without escaping </script> or <!-- sequences. Metadata containing </script><script>...</script>, for example an author name synced from _data/authors.yml or edited through a CMS, breaks out of the meta tag or the JSON-LD script block and runs as script on every page that includes the SEO tag, leading to cross-site scripting. The fix applies escape_once to the remaining attribute outputs and adds a filter that escapes the characters that can close the script block in the JSON-LD payload.