From 8eb7aea08b27c0f1bcdeec3171880a6fcf28aa9a Mon Sep 17 00:00:00 2001
From: SkyZeroZx <73321943+SkyZeroZx@users.noreply.github.com>
Date: Sun, 28 Jun 2026 00:15:56 -0500
Subject: [PATCH] fix(core): reject dynamic script host elements

The previous fix for GHSA-692r-grfm-v8x7 was incomplete because it rejected script tags only when locating an explicit host element. Dynamic component instantiation can also infer the host element from the component selector.

Move the script-host rejection to the point where ComponentFactory has resolved the host element for either path, so createComponent rejects script hosts consistently.

(cherry picked from commit 135f3755b4a2c4920c2f056bfe224a7bc067bb83)
---
 packages/core/src/render3/component_ref.ts          | 10 ++++++++++
 packages/core/src/render3/instructions/shared.ts    |  7 -------
 packages/core/test/acceptance/security_spec.ts      | 13 +++++++++++++
 .../bundle.golden_symbols.json                      |  1 +
 .../test/bundling/defer/bundle.golden_symbols.json  |  1 +
 .../forms_reactive/bundle.golden_symbols.json       |  1 +
 .../bundle.golden_symbols.json                      |  1 +
 .../bundling/hydration/bundle.golden_symbols.json   |  1 +
 .../test/bundling/router/bundle.golden_symbols.json |  1 +
 .../standalone_bootstrap/bundle.golden_symbols.json |  1 +
 10 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/packages/core/src/render3/component_ref.ts b/packages/core/src/render3/component_ref.ts
index 5cca900962a..4baea34e9f6 100644
--- a/packages/core/src/render3/component_ref.ts
+++ b/packages/core/src/render3/component_ref.ts
@@ -193,6 +193,15 @@ function createHostElement(componentDef: ComponentDef<unknown>, renderer: Render
   return createElementNode(renderer, tagName, namespace);
 }
 
+function assertNotScriptHostElement(tagName: string | null | undefined): void {
+  if (tagName?.toLowerCase() === 'script') {
+    throw new RuntimeError(
+      RuntimeErrorCode.UNSAFE_VALUE_IN_SCRIPT,
+      ngDevMode && `"<script>" tag is not allowed as a component host element.`,
+    );
+  }
+}
+
 /**
  * Infers the tag name that should be used for a component based on its definition.
  * @param componentDef Definition for which to resolve the tag name.
@@ -283,6 +292,7 @@ export class ComponentFactory<T> extends AbstractComponentFactory<T> {
             rootViewInjector,
           )
         : createHostElement(cmpDef, hostRenderer);
+      assertNotScriptHostElement(hostElement?.tagName);
       const hasInputBindings =
         componentBindings?.some(isInputBinding) ||
         directives?.some((d) => typeof d !== 'function' && d.bindings.some(isInputBinding));
diff --git a/packages/core/src/render3/instructions/shared.ts b/packages/core/src/render3/instructions/shared.ts
index a2b9268e495..6e611a62717 100644
--- a/packages/core/src/render3/instructions/shared.ts
+++ b/packages/core/src/render3/instructions/shared.ts
@@ -21,7 +21,6 @@ import {stringify} from '../../util/stringify';
 import {assertFirstCreatePass, assertHasParent, assertLView} from '../assert';
 import {attachPatchData} from '../context_discovery';
 import {getNodeInjectable, getOrCreateNodeInjectorForNode} from '../di';
-import {RuntimeError, RuntimeErrorCode} from '../../errors';
 import {throwMultipleComponentError} from '../errors';
 import {ComponentDef, ComponentTemplate, DirectiveDef, RenderFlags} from '../interfaces/definition';
 import {
@@ -178,12 +177,6 @@ export function locateHostElement(
   // projection.
   const preserveContent = preserveHostContent || encapsulation === ViewEncapsulation.ShadowDom;
   const rootElement = renderer.selectRootElement(elementOrSelector, preserveContent);
-  if (rootElement.tagName.toLowerCase() === 'script') {
-    throw new RuntimeError(
-      RuntimeErrorCode.UNSAFE_VALUE_IN_SCRIPT,
-      ngDevMode && `"<script>" tag is not allowed as a component host element.`,
-    );
-  }
   applyRootElementTransform(rootElement as HTMLElement);
   return rootElement;
 }
diff --git a/packages/core/test/acceptance/security_spec.ts b/packages/core/test/acceptance/security_spec.ts
index 1277e7b26f7..8207fba3c67 100644
--- a/packages/core/test/acceptance/security_spec.ts
+++ b/packages/core/test/acceptance/security_spec.ts
@@ -807,6 +807,19 @@ describe('innerHTML processing', () => {
   });
 });
 describe('Component host element validation', () => {
+  it('should throw an error when dynamically creating a component with a script selector', () => {
+    @Component({
+      selector: 'script',
+      template: '',
+    })
+    class ScriptHost {}
+
+    const environmentInjector = TestBed.inject(EnvironmentInjector);
+    expect(() => {
+      createComponent(ScriptHost, {environmentInjector});
+    }).toThrowError(/"<script>" tag is not allowed as a component host element/);
+  });
+
   it('should throw an error when dynamically mounting a component onto a script tag', () => {
     @Component({
       selector: 'my-sink',
diff --git a/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json b/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json
index ab8628db628..59ca1450e31 100644
--- a/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json
@@ -344,6 +344,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "attachPatchData",
       "balancePreviousStylesIntoKeyframes",
       "balanceProperties",
diff --git a/packages/core/test/bundling/defer/bundle.golden_symbols.json b/packages/core/test/bundling/defer/bundle.golden_symbols.json
index da834e72bd9..06a7c51664d 100644
--- a/packages/core/test/bundling/defer/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/defer/bundle.golden_symbols.json
@@ -315,6 +315,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "attachPatchData",
       "bind",
       "bindingUpdated",
diff --git a/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json b/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json
index 3995800407d..8f6f8410f77 100644
--- a/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json
@@ -375,6 +375,7 @@
       "assertAllValuesPresent",
       "assertControlPresent",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertPlatform",
       "attachPatchData",
       "baseElement",
diff --git a/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json b/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json
index d04f68c0d7a..4a90694b0d2 100644
--- a/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json
@@ -380,6 +380,7 @@
       "assertAllValuesPresent",
       "assertControlPresent",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertPlatform",
       "attachPatchData",
       "baseElement",
diff --git a/packages/core/test/bundling/hydration/bundle.golden_symbols.json b/packages/core/test/bundling/hydration/bundle.golden_symbols.json
index 95e129d3fd2..ffdeb85ee69 100644
--- a/packages/core/test/bundling/hydration/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/hydration/bundle.golden_symbols.json
@@ -311,6 +311,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "attachPatchData",
       "baseElement",
       "bind",
diff --git a/packages/core/test/bundling/router/bundle.golden_symbols.json b/packages/core/test/bundling/router/bundle.golden_symbols.json
index 4c455073c98..bd1c601b631 100644
--- a/packages/core/test/bundling/router/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/router/bundle.golden_symbols.json
@@ -421,6 +421,7 @@
       "arrRemove",
       "arrayEquals",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "attachPatchData",
       "baseElement",
       "bind",
diff --git a/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json b/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json
index 48aa7202a51..09c050f0035 100644
--- a/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json
@@ -250,6 +250,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "attachPatchData",
       "baseElement",
       "bind",