SVG <script> and [innerHTML]/[textContent] text can execute in Angular templates #68642

Which @angular/* package(s) are the source of the bug?

compiler

Is this a regression?

No

Description

Angular strips <script> elements from component templates during compilation. However, SVG descendants appear to be represented internally with a namespace-prefixed name such as :svg:script.

This allows an Angular component template to contain:

<svg>
  <script>
    window.__angularSvgScriptPov = 'executed';
    document.body.setAttribute('data-svg-script-pov', 'executed');
  </script>
</svg>

The script survives compilation and executes in the browser.

A more concerning variant is that dynamic text assigned through an Angular binding can also become executable script text inside SVG <script>:

<svg>
<!--  No bypass is needed to allow this -->
  <script [innerHTML]="payload"></script> // same with [textContent]
</svg>

Also same behavior bypass when
and code = 'javascript:alert(1)';

<svg width="120" height="24" aria-label="svg-script-pov">
  <script  [textContent]="code"></script>
  <text x="0" y="16">PoV</text>
</svg>

Angular should strip, reject, or otherwise prevent SVG <script> elements from being emitted or populated with executable script content.

should not allow an untrusted plain string to become executable JavaScript.

Please provide a link to a minimal reproduction of the bug

This issue was previously reported to the Google VRP. The original PoV and discussion can be seen here, if accessible: https://issuetracker.google.com/u/1/issues/509941006

Additionally, it was tested on Angular 22 Next.9 and the latest next version