From d7f70616a03aa00274f0a91c49f7a6fe4b2e3535 Mon Sep 17 00:00:00 2001
From: SkyZeroZx <73321943+SkyZeroZx@users.noreply.github.com>
Date: Sun, 28 Jun 2026 00:15:56 -0500
Subject: [PATCH] fix(core): reject dynamic script host elements

The previous fix for GHSA-692r-grfm-v8x7 was incomplete because it rejected script tags only when locating an explicit host element. Dynamic component instantiation can also infer the host element from the component selector.

Move the script-host rejection to the point where ComponentFactory has resolved the host element for either path, so createComponent rejects script hosts consistently.
---
 packages/core/src/render3/component_ref.ts          | 10 ++++++++++
 packages/core/src/render3/instructions/shared.ts    |  7 -------
 packages/core/test/acceptance/security_spec.ts      | 13 +++++++++++++
 .../bundle.golden_symbols.json                      |  1 +
 .../create_component/bundle.golden_symbols.json     |  1 +
 .../test/bundling/defer/bundle.golden_symbols.json  |  1 +
 .../forms_reactive/bundle.golden_symbols.json       |  1 +
 .../bundle.golden_symbols.json                      |  1 +
 .../bundling/hydration/bundle.golden_symbols.json   |  1 +
 .../test/bundling/router/bundle.golden_symbols.json |  1 +
 .../standalone_bootstrap/bundle.golden_symbols.json |  1 +
 11 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/packages/core/src/render3/component_ref.ts b/packages/core/src/render3/component_ref.ts
index 0e664e9a1b9..71c5056cc0d 100644
--- a/packages/core/src/render3/component_ref.ts
+++ b/packages/core/src/render3/component_ref.ts
@@ -183,6 +183,15 @@ function createHostElement(componentDef: ComponentDef<unknown>, renderer: Render
   return createElementNode(renderer, tagName, namespace);
 }
 
+function assertNotScriptHostElement(tagName: string | null | undefined): void {
+  if (tagName?.toLowerCase() === 'script') {
+    throw new RuntimeError(
+      RuntimeErrorCode.UNSAFE_VALUE_IN_SCRIPT,
+      ngDevMode && `"<script>" tag is not allowed as a component host element.`,
+    );
+  }
+}
+
 /**
  * Infers the tag name that should be used for a component based on its definition.
  * @param componentDef Definition for which to resolve the tag name.
@@ -303,6 +312,7 @@ export class ComponentFactory<T> {
     const hostElement = rootSelectorOrNode
       ? locateHostElement(hostRenderer, rootSelectorOrNode, cmpDef.encapsulation, rootViewInjector)
       : createHostElement(cmpDef, hostRenderer);
+    assertNotScriptHostElement(hostElement?.tagName);
 
     const sharedStylesHost = rootViewInjector.get(SHARED_STYLES_HOST, null);
     const styleHost = getStyleHost(
diff --git a/packages/core/src/render3/instructions/shared.ts b/packages/core/src/render3/instructions/shared.ts
index 8538f287088..3ae9b3cd732 100644
--- a/packages/core/src/render3/instructions/shared.ts
+++ b/packages/core/src/render3/instructions/shared.ts
@@ -15,7 +15,6 @@ import {ViewEncapsulation} from '../../metadata/view';
 import {validateAgainstEventProperties} from '../../sanitization/sanitization';
 
 import {ProfilerEvent} from '../../../primitives/devtools';
-import {RuntimeError, RuntimeErrorCode} from '../../errors';
 import {normalizeDebugBindingName, normalizeDebugBindingValue} from '../../ng_reflect';
 import {assertIndexInRange, assertNotSame} from '../../util/assert';
 import {escapeCommentText} from '../../util/dom';
@@ -181,12 +180,6 @@ export function locateHostElement(
     encapsulation === ViewEncapsulation.ShadowDom ||
     encapsulation === ViewEncapsulation.ExperimentalIsolatedShadowDom;
   const rootElement = renderer.selectRootElement(elementOrSelector, preserveContent);
-  if (rootElement.tagName.toLowerCase() === 'script') {
-    throw new RuntimeError(
-      RuntimeErrorCode.UNSAFE_VALUE_IN_SCRIPT,
-      ngDevMode && `"<script>" tag is not allowed as a component host element.`,
-    );
-  }
   applyRootElementTransform(rootElement as HTMLElement);
   return rootElement;
 }
diff --git a/packages/core/test/acceptance/security_spec.ts b/packages/core/test/acceptance/security_spec.ts
index cc803a14f9a..a317064ac1b 100644
--- a/packages/core/test/acceptance/security_spec.ts
+++ b/packages/core/test/acceptance/security_spec.ts
@@ -873,6 +873,19 @@ describe('innerHTML processing', () => {
 });
 
 describe('Component host element validation', () => {
+  it('should throw an error when dynamically creating a component with a script selector', () => {
+    @Component({
+      selector: 'script',
+      template: '',
+    })
+    class ScriptHost {}
+
+    const environmentInjector = TestBed.inject(EnvironmentInjector);
+    expect(() => {
+      createComponent(ScriptHost, {environmentInjector});
+    }).toThrowError(/"<script>" tag is not allowed as a component host element/);
+  });
+
   it('should throw an error when dynamically mounting a component onto a script tag', () => {
     @Component({
       selector: 'my-sink',
diff --git a/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json b/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json
index 8b890c06e80..b2a7da2856a 100644
--- a/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/animations-standalone/bundle.golden_symbols.json
@@ -338,6 +338,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertTypeDefined",
       "attachPatchData",
       "balancePreviousStylesIntoKeyframes",
diff --git a/packages/core/test/bundling/create_component/bundle.golden_symbols.json b/packages/core/test/bundling/create_component/bundle.golden_symbols.json
index 8fa1b3e48f9..1df8f3b7138 100644
--- a/packages/core/test/bundling/create_component/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/create_component/bundle.golden_symbols.json
@@ -263,6 +263,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertTypeDefined",
       "attachPatchData",
       "baseElement",
diff --git a/packages/core/test/bundling/defer/bundle.golden_symbols.json b/packages/core/test/bundling/defer/bundle.golden_symbols.json
index 2d80dde6664..08da59bce48 100644
--- a/packages/core/test/bundling/defer/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/defer/bundle.golden_symbols.json
@@ -309,6 +309,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertTypeDefined",
       "attachPatchData",
       "bind",
diff --git a/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json b/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json
index 2a0959fa6d1..82c368294e5 100644
--- a/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/forms_reactive/bundle.golden_symbols.json
@@ -389,6 +389,7 @@
       "assertAllValuesPresent",
       "assertControlPresent",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertPlatform",
       "assertTypeDefined",
       "attachPatchData",
diff --git a/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json b/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json
index 03d015997a4..600e48744a8 100644
--- a/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/forms_template_driven/bundle.golden_symbols.json
@@ -390,6 +390,7 @@
       "assertAllValuesPresent",
       "assertControlPresent",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertPlatform",
       "assertTypeDefined",
       "attachPatchData",
diff --git a/packages/core/test/bundling/hydration/bundle.golden_symbols.json b/packages/core/test/bundling/hydration/bundle.golden_symbols.json
index 351b0162f29..bc01eefdee0 100644
--- a/packages/core/test/bundling/hydration/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/hydration/bundle.golden_symbols.json
@@ -375,6 +375,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertTypeDefined",
       "attachPatchData",
       "baseElement",
diff --git a/packages/core/test/bundling/router/bundle.golden_symbols.json b/packages/core/test/bundling/router/bundle.golden_symbols.json
index a8e39cc0b77..4bfb687efc3 100644
--- a/packages/core/test/bundling/router/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/router/bundle.golden_symbols.json
@@ -423,6 +423,7 @@
       "arrRemove",
       "arrayEquals",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertTypeDefined",
       "attachPatchData",
       "baseElement",
diff --git a/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json b/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json
index f50662bcafd..f39040273e1 100644
--- a/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json
+++ b/packages/core/test/bundling/standalone_bootstrap/bundle.golden_symbols.json
@@ -244,6 +244,7 @@
       "areAnimationSupported",
       "arrRemove",
       "assertNotDestroyed",
+      "assertNotScriptHostElement",
       "assertTypeDefined",
       "attachPatchData",
       "baseElement",