angular/angular · error · RuntimeError

NG0905

NG0905

Error message

unsafe value used in a script context

What it means

Error "unsafe value used in a script context" thrown in angular/angular.

Source

Thrown at packages/core/src/sanitization/sanitization.ts:172

 * bypassSanitizationTrustScript}.
 *
 * @param unsafeScript untrusted `script`, typically from the user.
 * @returns `url` string which is safe to bind to the `<script>` element such as `<img src>`,
 * because only trusted `scripts` have been allowed to pass.
 *
 * @codeGenApi
 */
export function ɵɵsanitizeScript(unsafeScript: any): TrustedScript | string {
  const sanitizer = getSanitizer();
  if (sanitizer) {
    return trustedScriptFromStringBypass(
      sanitizer.sanitize(SecurityContext.SCRIPT, unsafeScript) || '',
    );
  }
  if (allowSanitizationBypassAndThrow(unsafeScript, BypassType.Script)) {
    return trustedScriptFromStringBypass(unwrapSafeValue(unsafeScript));
  }
  throw new RuntimeError(
    RuntimeErrorCode.UNSAFE_VALUE_IN_SCRIPT,
    ngDevMode && 'unsafe value used in a script context',
  );
}

/**
 * A template tag function for promoting the associated constant literal to a
 * TrustedHTML. Interpolation is explicitly not allowed.
 *
 * @param html constant template literal containing trusted HTML.
 * @returns TrustedHTML wrapping `html`.
 *
 * @security This is a security-sensitive function and should only be used to
 * convert constant values of attributes and properties found in
 * application-provided Angular templates to TrustedHTML.
 *
 * @codeGenApi
 */

View on GitHub (pinned to 51cb07e980)

Solutions

1. Remove the unsafe script value or use an approved sanitization bypass.

When it happens

Trigger: Thrown at packages/core/src/sanitization/sanitization.ts:172 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of angular/angular@51cb07e980 (2026-08-22). Data as JSON: /api/errors/45db86cac830863f. Report an issue: GitHub.