SA-2026-001: Captured page titles could close the JSON-LD script block and run on the site

What it is

Every page carries structured data in a <script type="application/ld+json"> block. Its headline and description came from page titles, and on source pages those titles are the titles of captured third-party pages. They were serialised with json.dumps, which does not escape "<" or "/".

What an attacker could do

A publisher whose page title held "</script><script>..." would have run script on every source page of the site, once a collector captured it. No title did; the flaw was latent.

How: Publish a page with a crafted <title>; wait for a collector to capture it; the export copies the title into data/sources.json; the build writes it raw into the JSON-LD block.

Root cause

Data was serialised for JSON, not for JSON inside HTML. Two contexts, one encoder.

What contributed

• Five places built <script> blocks from data; one of them (the feed viewer config) already escaped "</", so the knowledge existed but was not shared as a helper.
• The gate checked links and credentials, never the shape of script blocks.

What was not in place

A single helper for JSON inside <script>, and a gate check that every JSON script block parses.

The fix

J() escapes "<", ">" and "&" in all JSON script blocks.

What prevents it now

The gate fails on any JSON script block that does not parse or contains "<" (security_check.py); the Content-Security-Policy (SA-2026-018) blocks the script even if it gets in.