An Angular component created with createComponent respected script or namespaced script elements as attaches points, bypassing normal script-execution restrictions. Attackers that control the host element or selector passed to createComponent could mount a component directly onto a <script> tag or an element like <svg:script>, causing untrusted code to run in the browser. This flaw is a client‑side Cross‑Site Scripting vulnerability that can lead to arbitrary script execution by the user’s client. The weakness is classified as "Type of Code Injection" and listed as CWE‑79.

Angular and its @angular/core package, specifically versions before 22.0.0‑rc.2, 21.2.15, 20.3.22 and 19.2.23. Any application using those releases and calling createComponent with a selector that could be manipulated by an attacker is affected.

The CVSS score of 5.3 places the flaw in the moderate range. There is no EPSS data and the vulnerability is not published in the KEV catalog. The attack requires an attacker who can supply a selector or host element for createComponent—typically through application code that accepts user input. Because the flaw sits inside a legitimate Angular API, exploitation is possible in any context where that API is exposed to untrusted input, making the vulnerability relevant in real‑world scenarios.