diff --git a/packages/core/src/compiler/compositionScoping.test.ts b/packages/core/src/compiler/compositionScoping.test.ts
index 5a0a0cd3a..5d806ccdc 100644
--- a/packages/core/src/compiler/compositionScoping.test.ts
+++ b/packages/core/src/compiler/compositionScoping.test.ts
@@ -572,14 +572,15 @@ window.__afterTimeline = window.__timelines.scene;
     expect(scoped).toContain('[data-composition-id="chrome-overlay"] .child-element');
   });
 
-  it("wraps scoped composition script source as a string literal", () => {
+  it("escapes </script> in scoped composition script source to prevent injection", () => {
     const wrapped = wrapScopedCompositionScript(
       'window.payload = "</script><script>window.pwned = true;</script>";',
       "scene",
     );
 
-    expect(wrapped).toContain('Function("document", "gsap", "window", "__hyperframes", ');
-    expect(wrapped).toContain('\\"</script><script>window.pwned = true;</script>\\"');
+    expect(wrapped).toContain("(function(document, gsap, window, __hyperframes)");
+    expect(wrapped).not.toContain("</script><script>");
+    expect(wrapped).toContain("<\\/script>");
   });
 
   it("wraps unscoped composition script source as a string literal", () => {
diff --git a/packages/core/src/compiler/compositionScoping.ts b/packages/core/src/compiler/compositionScoping.ts
index 72e9cbbf8..8ec81fc2b 100644
--- a/packages/core/src/compiler/compositionScoping.ts
+++ b/packages/core/src/compiler/compositionScoping.ts
@@ -216,7 +216,6 @@ export function wrapScopedCompositionScript(
   const authoredRootIdFormsLiteral = JSON.stringify(
     getAuthoredRootIdSelectorForms(authoredRootId?.trim() || ""),
   );
-  const sourceLiteral = JSON.stringify(source);
   return `(function(){
   var __hfCompId = ${compositionIdLiteral};
   var __hfTimelineCompId = ${timelineCompositionIdLiteral};
@@ -486,8 +485,9 @@ export function wrapScopedCompositionScript(
       });
   var __hfRun = function() {
     try {
-      var __hfScript = Function("document", "gsap", "window", "__hyperframes", ${sourceLiteral});
-      __hfScript.call(window, __hfScopedDocument, __hfScopedGsap, __hfScopedWindow, __hfScopedHyperframes);
+      (function(document, gsap, window, __hyperframes) {
+${source.replace(/<\/(script)/gi, "<\\/$1")}
+      }).call(window, __hfScopedDocument, __hfScopedGsap, __hfScopedWindow, __hfScopedHyperframes);
     } catch (_err) {
       console.error(__hfErrorLabel, __hfCompId, _err);
     }
diff --git a/packages/core/src/compiler/htmlBundler.test.ts b/packages/core/src/compiler/htmlBundler.test.ts
index f955ef5ea..bbf5bfef6 100644
--- a/packages/core/src/compiler/htmlBundler.test.ts
+++ b/packages/core/src/compiler/htmlBundler.test.ts
@@ -758,8 +758,8 @@ describe("bundleToSingleHtml", () => {
     expect(bundled).toContain('[data-composition-id="scene"] .title { color: red; }');
     expect(bundled).toContain("new Proxy(window.document");
     expect(bundled).toContain("new Proxy(__hfBaseGsap");
-    expect(bundled).toContain('Function("document", "gsap", "window", "__hyperframes",');
-    expect(bundled).toContain("tl.to('.title'");
+    expect(bundled).toContain("(function(document, gsap, window, __hyperframes)");
+    expect(bundled).toContain('tl.to(".title"');
   });
 
   it("isolates sibling instances of the same external sub-composition", async () => {