Angular’s @angular/core dynamic component creation API contains a flaw that allows a component to be mounted directly onto a <script> or namespaced script element. Because createComponent accepts a selector string that may come from untrusted input, an attacker can cause the framework to instantiate a component on a tag that executes scripts. The flaw enables the attacker to execute arbitrary code in the client’s browser, resulting in client‑side Cross‑Site Scripting. The vulnerability represents a combination of input validation (CWE‑79) and component selector handling (CWE‑791) weaknesses.

Angular framework versions prior to 22.0.0‑rc.2, 21.2.15, 20.3.22, and 19.2.23 in the @angular/core package are vulnerable. Upgrading to any release that incorporates the fix removes the vulnerability.

The CVSS score of 5.3 places the vulnerability in the moderate severity range. The EPSS score is less than 1% indicating a very low likelihood of exploitation to date, and it is not listed in CISA’s KEV catalog. The flaw can be exploited without privileged access; an application that forwards user input to createComponent can be abused to inject a <script> tag that runs arbitrary JavaScript. While the CVE description does not detail downstream impacts, it is inferred that, as a result of script execution, an attacker could potentially steal information or alter the user’s experience.