From 5e9cffaf85feb3d845aac47deccb5426ff4471d4 Mon Sep 17 00:00:00 2001
From: Didier Garcia <digarcia@twilio.com>
Date: Fri, 4 Sep 2026 15:44:10 -0400
Subject: [PATCH] fix(browser): resolve CDN and write key only from the tag
 that loaded us

SECOPS-25767 / LIBRARIES-3140.

getCDNUrlFromScriptTag(), getLegacyAJSPath() and getWriteKey() each scanned
every <script> in the document and accepted a match on src shape alone
(/analytics\.js\/v1\/.../), with no proof the tag had loaded the SDK and no
origin check. The shape is attacker-controlled, so given the ability to inject
markup into the page - but not to execute script - an attacker could add
https://evil.example/analytics.js/v1/<writeKey>/analytics.min.js and redirect
the settings fetch, and transitively remote-plugin script loading, to their own
origin. That escalates HTML injection to script execution. The tag did not need
to execute: one inserted via innerHTML is never run by the browser, but it is
in the DOM and was still read.

CDN resolution is now, in order:

  1. an explicit cdnURL / window.analytics._cdn
  2. the tag that actually loaded the SDK (document.currentScript)
  3. a tag whose derived CDN base is exactly one of our own origins
     (https://cdn.segment.com, https://cdn.segment.build)
  4. the default https://cdn.segment.com

The write key is read from that same trusted src, after the existing embedded
write key and window.analytics._writeKey. It no longer falls back to scanning
the DOM, so a page with no trusted tag now yields no write key rather than a
sniffed one.

document.currentScript is only valid during the synchronous top-level run of
the loading script, so it is snapshotted at boot via captureInitialScriptSrc()
in the UMD and standalone entrypoints. Later callers read the snapshot, which
keeps the CSP-fallback handler, the old-browser polyfill onload path and
deferred .load() working - all of them run where currentScript is null.

(3) is a weaker guarantee than (2) - it proves the origin is ours, not that the
tag loaded us - and exists only for the bundler and tag-manager cases. It
compares the full derived base rather than just the host, because the base
comes from the regex's greedy prefix capture: matching on host alone would
accept any path under an allowlisted origin, so a self-serve mirror such as
cdn.jsdelivr.net could serve
cdn.jsdelivr.net/npm/<pkg>/analytics.js/v1/<key>/analytics.min.js and control
the settings we fetch. Real jsDelivr URLs for this SDK do not match the regex,
so it is not on the allowlist.

Proxy and self-hosted CDN setups are preserved: the proxy tag is the tag that
loads the SDK, so it is trusted via (2), including first-party CDNs on a
different registrable domain than the page. Setups where the SDK is loaded by a
bundler alongside a snippet served from a non-Segment CDN no longer auto-detect
that CDN and must pass cdnURL explicitly.

Tests now model document.currentScript at boot; the previous fixtures did not.
---
 .changeset/secops-25767-cdn-trust.md          |  49 +++++
 .../browser/__tests__/csp-detection.test.ts   |  11 ++
 .../__tests__/standalone-analytics.test.ts    |  11 ++
 .../src/browser/__tests__/standalone.test.ts  |  11 ++
 packages/browser/src/browser/browser-umd.ts   |  10 +-
 .../src/browser/standalone-analytics.ts       |  33 ++--
 packages/browser/src/browser/standalone.ts    |  10 +-
 .../src/lib/__tests__/parse-cdn.test.ts       | 176 ++++++++++++------
 packages/browser/src/lib/parse-cdn.ts         | 128 ++++++++++---
 9 files changed, 333 insertions(+), 106 deletions(-)
 create mode 100644 .changeset/secops-25767-cdn-trust.md

diff --git a/.changeset/secops-25767-cdn-trust.md b/.changeset/secops-25767-cdn-trust.md
new file mode 100644
index 000000000..aa0233af2
--- /dev/null
+++ b/.changeset/secops-25767-cdn-trust.md
@@ -0,0 +1,49 @@
+---
+'@segment/analytics-next': minor
+---
+
+Harden CDN and write-key resolution (SECOPS-25767).
+
+**Behavior change — read this if you proxy or self-host the SDK.** The SDK no
+longer discovers its CDN or write key by scanning arbitrary `<script>` tags in
+the page. Two configurations that previously worked by auto-detection now need
+explicit configuration:
+
+1. **SDK loaded by a bundler alongside a snippet on a non-Segment CDN.** The
+   snippet's CDN is no longer auto-detected; resolution falls back to
+   `https://cdn.segment.com`. Pass `cdnURL` explicitly:
+   `AnalyticsBrowser.load({ writeKey, cdnURL: 'https://your.cdn' })`. Note that
+   if your CSP allowlists only your own CDN, the settings request to
+   `cdn.segment.com` will be blocked and analytics will fail to initialize -
+   this does not degrade silently.
+2. **Pages relying on the write key being sniffed out of the DOM.**
+   `getWriteKey()` no longer scans; it reads the embedded write key,
+   `window.analytics._writeKey`, then the tag that loaded the SDK. A page with
+   none of those now yields no write key and analytics will not initialize.
+   Snippet versions 4.15.3 and later set `_writeKey` and are unaffected.
+
+Standard snippet installations, and proxy or self-hosted setups where the SDK is
+loaded from the proxy's own tag, are unaffected - including first-party CDNs on
+a different registrable domain than the page.
+
+**Why.** The SDK previously determined which origin to trust for its settings by
+scanning every `<script>` tag in the document and accepting a match on URL shape
+alone, with no proof the tag had loaded the SDK and no origin check. Because the
+shape is attacker-controlled, anyone able to inject markup into the page - but
+not to execute script - could add a Segment-shaped `<script src>` on their own
+origin and redirect the settings fetch, and transitively remote-plugin script
+loading, to that origin. The tag did not need to execute: one inserted via
+`innerHTML` is never run by the browser, but it is in the DOM and was still read.
+
+**What it does now.** CDN resolution, in order:
+
+1. an explicitly configured `cdnURL` / `window.analytics._cdn`
+2. the tag that actually loaded the SDK (`document.currentScript`, snapshotted at
+   boot so it also works from the CSP fallback handler, the polyfill `onload`,
+   and deferred `.load()` calls)
+3. a tag whose derived CDN base is exactly one of our own origins
+   (`https://cdn.segment.com`, `https://cdn.segment.build`)
+4. otherwise the default `https://cdn.segment.com`
+
+The write key is read from that same trusted source, after the existing embedded
+write key and `window.analytics._writeKey`.
diff --git a/packages/browser/src/browser/__tests__/csp-detection.test.ts b/packages/browser/src/browser/__tests__/csp-detection.test.ts
index c3efa8bcc..007459ad3 100644
--- a/packages/browser/src/browser/__tests__/csp-detection.test.ts
+++ b/packages/browser/src/browser/__tests__/csp-detection.test.ts
@@ -88,6 +88,17 @@ describe('CSP Detection', () => {
     documentSpy.mockImplementation(
       () => jsd.window.document as unknown as Document
     )
+
+    // SECOPS-25767: the SDK now trusts only the tag that loaded it. Model that
+    // by pointing document.currentScript at the analytics.min.js tag the
+    // snippet inserted, as the browser would during the bundle's boot.
+    const loaderTag = jsd.window.document.querySelector(
+      'script[src*="/analytics.js/v1/"]'
+    )
+    Object.defineProperty(jsd.window.document, 'currentScript', {
+      configurable: true,
+      get: () => loaderTag,
+    })
   })
 
   it('reverts to ajs classic in case of CSP errors', async () => {
diff --git a/packages/browser/src/browser/__tests__/standalone-analytics.test.ts b/packages/browser/src/browser/__tests__/standalone-analytics.test.ts
index d2bbd3d78..cf0d1346d 100644
--- a/packages/browser/src/browser/__tests__/standalone-analytics.test.ts
+++ b/packages/browser/src/browser/__tests__/standalone-analytics.test.ts
@@ -91,6 +91,17 @@ describe('standalone bundle', () => {
     documentSpy.mockImplementation(
       () => jsd.window.document as unknown as Document
     )
+
+    // SECOPS-25767: the SDK now derives the write key / CDN only from the tag
+    // that loaded it. Point document.currentScript at the analytics.min.js tag
+    // the snippet inserted, as the browser would during the bundle's boot.
+    const loaderTag = jsd.window.document.querySelector(
+      'script[src*="/analytics.js/v1/"]'
+    )
+    Object.defineProperty(jsd.window.document, 'currentScript', {
+      configurable: true,
+      get: () => loaderTag,
+    })
   })
 
   it('detects embedded write keys', async () => {
diff --git a/packages/browser/src/browser/__tests__/standalone.test.ts b/packages/browser/src/browser/__tests__/standalone.test.ts
index f5fed0fa1..52a10c1ee 100644
--- a/packages/browser/src/browser/__tests__/standalone.test.ts
+++ b/packages/browser/src/browser/__tests__/standalone.test.ts
@@ -84,6 +84,17 @@ describe('standalone bundle', () => {
     documentSpy.mockImplementation(
       () => jsd.window.document as unknown as Document
     )
+
+    // SECOPS-25767: the SDK now trusts only the tag that loaded it. Point
+    // document.currentScript at the analytics.min.js tag the snippet inserted,
+    // as the browser would during the bundle's boot.
+    const loaderTag = jsd.window.document.querySelector(
+      'script[src*="/analytics.js/v1/"]'
+    )
+    Object.defineProperty(jsd.window.document, 'currentScript', {
+      configurable: true,
+      get: () => loaderTag,
+    })
   })
 
   it('loads AJS on execution', async () => {
diff --git a/packages/browser/src/browser/browser-umd.ts b/packages/browser/src/browser/browser-umd.ts
index b64b7fd44..a0e4473d7 100644
--- a/packages/browser/src/browser/browser-umd.ts
+++ b/packages/browser/src/browser/browser-umd.ts
@@ -1,6 +1,14 @@
-import { getCDN, setGlobalCDNUrl } from '../lib/parse-cdn'
+import {
+  captureInitialScriptSrc,
+  getCDN,
+  setGlobalCDNUrl,
+} from '../lib/parse-cdn'
 import { setVersionType } from '../lib/version-type'
 
+// SECOPS-25767: snapshot the loading tag's src at boot, while
+// document.currentScript is still valid, before any async work runs.
+captureInitialScriptSrc()
+
 if (process.env.IS_WEBPACK_BUILD) {
   if (process.env.ASSET_PATH) {
     // @ts-ignore
diff --git a/packages/browser/src/browser/standalone-analytics.ts b/packages/browser/src/browser/standalone-analytics.ts
index b4f52c9c1..0db6d0f50 100644
--- a/packages/browser/src/browser/standalone-analytics.ts
+++ b/packages/browser/src/browser/standalone-analytics.ts
@@ -5,6 +5,7 @@ import {
   getGlobalAnalytics,
   setGlobalAnalytics,
 } from '../lib/global-analytics-helper'
+import { getTrustedScriptSrc } from '../lib/parse-cdn'
 
 function getWriteKey(): string | undefined {
   if (embeddedWriteKey()) {
@@ -16,34 +17,22 @@ function getWriteKey(): string | undefined {
     return analytics._writeKey
   }
 
+  // SECOPS-25767: resolve the write key only from a trusted tag - the one that
+  // actually loaded us (document.currentScript, snapshotted at boot so this
+  // also works from polyfill onload / deferred contexts where currentScript is
+  // null), or failing that a tag on a known public Segment CDN. Never from an
+  // arbitrary <script> in the DOM: a sniffed write key could redirect a
+  // customer's event stream to an attacker-owned workspace.
   const regex = /http.*\/analytics\.js\/v1\/([^/]*)(\/platform)?\/analytics.*/
-  const scripts = Array.prototype.slice.call(
-    document.querySelectorAll('script')
-  )
-  let writeKey: string | undefined = undefined
-
-  for (const s of scripts) {
-    const src = s.getAttribute('src') ?? ''
-    const result = regex.exec(src)
-
-    if (result && result[1]) {
-      writeKey = result[1]
-      break
-    }
-  }
-
-  if (!writeKey && document.currentScript) {
-    const script = document.currentScript as HTMLScriptElement
-    const src = script.src
-
+  const src = getTrustedScriptSrc()
+  if (src) {
     const result = regex.exec(src)
-
     if (result && result[1]) {
-      writeKey = result[1]
+      return result[1]
     }
   }
 
-  return writeKey
+  return undefined
 }
 
 export async function install(): Promise<void> {
diff --git a/packages/browser/src/browser/standalone.ts b/packages/browser/src/browser/standalone.ts
index 86d6346de..a76f08cef 100644
--- a/packages/browser/src/browser/standalone.ts
+++ b/packages/browser/src/browser/standalone.ts
@@ -1,7 +1,15 @@
 /* eslint-disable @typescript-eslint/no-floating-promises */
-import { getCDN, setGlobalCDNUrl } from '../lib/parse-cdn'
+import {
+  captureInitialScriptSrc,
+  getCDN,
+  setGlobalCDNUrl,
+} from '../lib/parse-cdn'
 import { setVersionType } from '../lib/version-type'
 
+// SECOPS-25767: snapshot the loading tag's src at boot, while
+// document.currentScript is still valid, before any async work runs.
+captureInitialScriptSrc()
+
 if (process.env.IS_WEBPACK_BUILD) {
   if (process.env.ASSET_PATH) {
     // @ts-ignore
diff --git a/packages/browser/src/lib/__tests__/parse-cdn.test.ts b/packages/browser/src/lib/__tests__/parse-cdn.test.ts
index 78d449286..ff6519592 100644
--- a/packages/browser/src/lib/__tests__/parse-cdn.test.ts
+++ b/packages/browser/src/lib/__tests__/parse-cdn.test.ts
@@ -1,16 +1,22 @@
 import { JSDOM, VirtualConsole } from 'jsdom'
-import { getCDN } from '../parse-cdn'
-
-function withTag(tag: string) {
-  const html = `
-    <!DOCTYPE html>
-      <head>
-        ${tag}
-      </head>
-      <body>
-      </body>
-    </html>
-    `.trim()
+
+// parse-cdn snapshots document.currentScript at first use, so each test needs a
+// fresh module instance. We re-require it after wiring up the DOM.
+let getCDN: typeof import('../parse-cdn').getCDN
+
+/**
+ * Render a document whose *loading* tag is `loaderSrc` (the one the browser
+ * would expose as document.currentScript), plus any number of `extraTags` that
+ * are present in the DOM but did NOT load the SDK (e.g. attacker-injected,
+ * possibly inert). Pass loaderSrc = null to model a context where
+ * document.currentScript is null (bundler/npm, async load, event handler).
+ */
+function withTags(loaderSrc: string | null, extraTags: string[] = []) {
+  const tags = [...extraTags, ...(loaderSrc ? [loaderSrc] : [])]
+    .map((src) => `<script src="${src}"></script>`)
+    .join('\n')
+
+  const html = `<!DOCTYPE html><head>${tags}</head><body></body>`.trim()
 
   const virtualConsole = new VirtualConsole()
   const jsd = new JSDOM(html, {
@@ -20,69 +26,125 @@ function withTag(tag: string) {
     virtualConsole,
   })
 
-  const windowSpy = jest.spyOn(global, 'window', 'get')
-
-  const documentSpy = jest.spyOn(global, 'document', 'get')
+  const doc = jsd.window.document
 
-  jest.spyOn(console, 'warn').mockImplementationOnce(() => {})
-
-  windowSpy.mockImplementation(() => {
-    return jsd.window as unknown as Window & typeof globalThis
+  // Point document.currentScript at the loader tag (the last one rendered),
+  // shadowing the prototype getter that otherwise returns null in jsdom.
+  const loaderEl = loaderSrc
+    ? doc.querySelector(`script[src="${loaderSrc}"]`)
+    : null
+  Object.defineProperty(doc, 'currentScript', {
+    configurable: true,
+    get: () => loaderEl,
   })
 
-  documentSpy.mockImplementation(
-    () => jsd.window.document as unknown as Document
-  )
+  jest.spyOn(console, 'warn').mockImplementationOnce(() => {})
+  jest
+    .spyOn(global, 'window', 'get')
+    .mockImplementation(
+      () => jsd.window as unknown as Window & typeof globalThis
+    )
+  jest
+    .spyOn(global, 'document', 'get')
+    .mockImplementation(() => doc as unknown as Document)
 }
 
 beforeEach(async () => {
   jest.restoreAllMocks()
   jest.resetAllMocks()
+  jest.resetModules()
+  ;({ getCDN } = await import('../parse-cdn'))
+})
+
+const SEGMENT_TAG =
+  'https://cdn.segment.com/analytics.js/v1/gA5MBlJXrtZaB5sMMZvCF6czfBcfzNO6/analytics.min.js'
+const CUSTOM_TAG =
+  'https://my.cdn.domain/analytics.js/v1/gA5MBlJXrtZaB5sMMZvCF6czfBcfzNO6/analytics.min.js'
+const EVIL_TAG = 'https://evil.example.com/x/analytics.js/v1/evilkey/platform'
+
+it('detects the existing segment cdn from the loading tag', () => {
+  withTags(SEGMENT_TAG)
+  expect(getCDN()).toBe('https://cdn.segment.com')
+})
+
+it('returns the overridden cdn if window.analytics._cdn is set', () => {
+  withTags(SEGMENT_TAG)
+  ;(window as any).analytics = { _cdn: 'http://foo.cdn.com' }
+  expect(getCDN()).toBe('http://foo.cdn.com')
+})
+
+it('detects custom / proxy cdns from the loading tag (proxy support preserved)', () => {
+  withTags(CUSTOM_TAG)
+  expect(getCDN()).toBe('https://my.cdn.domain')
+})
+
+it('falls back to Segment if the loading tag src does not match the pattern', () => {
+  withTags('https://my.cdn.proxy/custom-analytics.min.js')
+  expect(getCDN()).toBe('https://cdn.segment.com')
 })
 
-it('detects the existing segment cdn', () => {
-  withTag(`
-    <script src="https://cdn.segment.com/analytics.js/v1/gA5MBlJXrtZaB5sMMZvCF6czfBcfzNO6/analytics.min.js" />
-  `)
-  expect(getCDN()).toMatchInlineSnapshot(`"https://cdn.segment.com"`)
+it('falls back to Segment if there is no loading tag (currentScript null)', () => {
+  withTags(null)
+  expect(getCDN()).toBe('https://cdn.segment.com')
+})
+
+// --- SECOPS-25767 regression tests ---------------------------------------
+
+it('ignores a non-loading (injected) tag and trusts only the loader', () => {
+  // legit tag loaded us; an attacker-injected evil tag is also in the DOM.
+  withTags(SEGMENT_TAG, [EVIL_TAG])
+  expect(getCDN()).toBe('https://cdn.segment.com')
+})
+
+it('does NOT trust an injected tag when there is no valid loader', () => {
+  // no tag actually loaded us (currentScript null); an inert evil tag exists.
+  withTags(null, [EVIL_TAG])
+  expect(getCDN()).toBe('https://cdn.segment.com') // NOT evil.example.com
+})
+
+it('trusts the proxy loader even when an evil tag is also present', () => {
+  withTags(CUSTOM_TAG, [EVIL_TAG])
+  expect(getCDN()).toBe('https://my.cdn.domain')
+})
+
+// --- allowlisted fallback (no currentScript, e.g. bundler + snippet) --------
+
+it('falls back to a public Segment CDN tag when currentScript is unavailable', () => {
+  withTags(null, [SEGMENT_TAG])
+  expect(getCDN()).toBe('https://cdn.segment.com')
 })
 
-it('should return the overridden cdn if window.analytics._cdn is mutated', () => {
-  withTag(`
-  <script src="https://cdn.segment.com/analytics.js/v1/gA5MBlJXrtZaB5sMMZvCF6czfBcfzNO6/analytics.min.js" />
-  `)
-  // @ts-ignore
-  ;(window.analytics as any) = {
-    _cdn: 'http://foo.cdn.com',
-  }
-  expect(getCDN()).toMatchInlineSnapshot(`"http://foo.cdn.com"`)
+it('does NOT trust a path under an allowlisted origin (greedy-prefix abuse)', () => {
+  // The CDN base comes from the regex's greedy prefix capture, so a path under
+  // an allowlisted host must not be accepted - otherwise anyone who can
+  // publish under that path controls the settings we fetch.
+  withTags(null, [
+    'https://cdn.segment.com/npm/evil-pkg@1.0.0/analytics.js/v1/K/analytics.min.js',
+  ])
+  expect(getCDN()).toBe('https://cdn.segment.com')
 })
 
-it('if analytics is not loaded yet, should still return cdn', () => {
-  // is this an impossible state?
-  // @ts-ignore
-  window.analytics = undefined as any
-  withTag(`
-  <script src="https://cdn.segment.com/analytics.js/v1/gA5MBlJXrtZaB5sMMZvCF6czfBcfzNO6/analytics.min.js" />
-  `)
-  expect(getCDN()).toMatchInlineSnapshot(`"https://cdn.segment.com"`)
+it('does NOT trust a self-serve mirror (cdn.jsdelivr.net is not allowlisted)', () => {
+  withTags(null, [
+    'https://cdn.jsdelivr.net/npm/evil-pkg@1.0.0/analytics.js/v1/K/analytics.min.js',
+  ])
+  expect(getCDN()).toBe('https://cdn.segment.com')
 })
 
-it('detects custom cdns that match Segment in domain instrumentation patterns', () => {
-  withTag(`
-    <script src="https://my.cdn.domain/analytics.js/v1/gA5MBlJXrtZaB5sMMZvCF6czfBcfzNO6/analytics.min.js" />
-  `)
-  expect(getCDN()).toMatchInlineSnapshot(`"https://my.cdn.domain"`)
+it('does NOT fall back to a non-allowlisted tag (proxy) without currentScript', () => {
+  // a real proxy tag, but we cannot prove it loaded us -> refuse to trust it
+  withTags(null, [CUSTOM_TAG])
+  expect(getCDN()).toBe('https://cdn.segment.com')
 })
 
-it('falls back to Segment if CDN is used as a proxy', () => {
-  withTag(`
-    <script src="https://my.cdn.proxy/custom-analytics.min.js" />
-  `)
-  expect(getCDN()).toMatchInlineSnapshot(`"https://cdn.segment.com"`)
+it('does NOT fall back to an evil tag that mimics an allowlisted host', () => {
+  withTags(null, [
+    'https://cdn.segment.com.evil.example.com/analytics.js/v1/k/analytics.min.js',
+  ])
+  expect(getCDN()).toBe('https://cdn.segment.com')
 })
 
-it('falls back to Segment if the script is not at all present on the page', () => {
-  withTag('')
-  expect(getCDN()).toMatchInlineSnapshot(`"https://cdn.segment.com"`)
+it('ignores an evil tag and picks the allowlisted one in the fallback scan', () => {
+  withTags(null, [SEGMENT_TAG, EVIL_TAG])
+  expect(getCDN()).toBe('https://cdn.segment.com')
 })
diff --git a/packages/browser/src/lib/parse-cdn.ts b/packages/browser/src/lib/parse-cdn.ts
index 7c9531fca..dada36072 100644
--- a/packages/browser/src/lib/parse-cdn.ts
+++ b/packages/browser/src/lib/parse-cdn.ts
@@ -3,20 +3,110 @@ import { embeddedWriteKey } from './embedded-write-key'
 
 const analyticsScriptRegex =
   /(https:\/\/.*)\/analytics\.js\/v1\/(?:.*?)\/(?:platform|analytics.*)?/
-const getCDNUrlFromScriptTag = (): string | undefined => {
-  let cdn: string | undefined
+
+/**
+ * The `src` of the script tag that actually loaded the SDK, snapshotted at boot.
+ *
+ * SECOPS-25767: previously the CDN was resolved by scanning EVERY <script> tag
+ * in the document and keeping the last match. That let any pre-existing (even
+ * inert) attacker-shaped <script src> redirect the SDK's config origin. We now
+ * trust only `document.currentScript` - the tag that actually executed us.
+ *
+ * `document.currentScript` is only valid during the synchronous top-level run of
+ * the loading script, so we snapshot it here and read the snapshot from the
+ * async contexts that would otherwise see `null` (CSP fallback handler,
+ * polyfill script.onload, deferred `.load()`).
+ */
+let _initialScriptSrc: string | undefined
+
+const readCurrentScriptSrc = (): string | undefined => {
+  if (typeof document === 'undefined') return undefined
+  const current = document.currentScript as HTMLScriptElement | null
+  const src = current?.getAttribute('src') || current?.src || ''
+  return analyticsScriptRegex.test(src) ? src : undefined
+}
+
+/**
+ * Snapshot the loading tag's src. Safe to call multiple times; only the first
+ * successful (analytics-shaped) read is kept. Entrypoints call this at module
+ * load, while `document.currentScript` still points at the SDK's own tag.
+ */
+export const captureInitialScriptSrc = (): void => {
+  if (_initialScriptSrc) return
+  const src = readCurrentScriptSrc()
+  if (src) _initialScriptSrc = src
+}
+
+const getInitialScriptSrc = (): string | undefined => {
+  // Prefer the boot snapshot; fall back to a live read in case getCDN() itself
+  // is the first thing invoked while currentScript is still valid.
+  if (!_initialScriptSrc) captureInitialScriptSrc()
+  return _initialScriptSrc
+}
+
+/**
+ * Origins Segment publishes analytics.js from. These are the only origins we
+ * will trust from a tag we cannot prove loaded us.
+ *
+ * Deliberately origin-only, with no path component. The CDN base is taken from
+ * the regex's greedy prefix capture, so allowing a path here would let anyone
+ * who can publish under that path supply the settings we then fetch. That is
+ * why a self-serve mirror such as cdn.jsdelivr.net must not be listed: an
+ * attacker could publish an npm package and serve
+ * cdn.jsdelivr.net/npm/<pkg>/analytics.js/v1/<key>/analytics.min.js. (Real
+ * jsDelivr URLs for this SDK don't match analyticsScriptRegex anyway, so
+ * listing it bought no legitimate coverage.)
+ */
+const PUBLIC_CDN_ALLOWLIST = [
+  'https://cdn.segment.com',
+  'https://cdn.segment.build',
+]
+
+/**
+ * True only if `cdnBase` is exactly an allowlisted origin - no path, no
+ * userinfo, no port games.
+ */
+const isAllowlistedCDN = (cdnBase: string): boolean =>
+  PUBLIC_CDN_ALLOWLIST.indexOf(cdnBase.toLowerCase()) !== -1
+
+/**
+ * Fallback for when `document.currentScript` could not identify us (SDK loaded
+ * via a bundler alongside a snippet, some tag-manager setups). We scan the DOM
+ * like we used to, but only trust a tag whose derived CDN base is exactly one
+ * of our own origins. This is a weaker guarantee than (1) - it proves only that
+ * the origin is ours, not that the tag loaded us - so keep the allowlist to
+ * origins whose content we control.
+ */
+const getAllowlistedCDNFromScriptTag = (): string | undefined => {
+  if (typeof document === 'undefined') return undefined
   const scripts = Array.prototype.slice.call(
     document.querySelectorAll('script')
   )
+  let src: string | undefined
   scripts.forEach((s) => {
-    const src = s.getAttribute('src') ?? ''
-    const result = analyticsScriptRegex.exec(src)
-
-    if (result && result[1]) {
-      cdn = result[1]
+    const candidate = s.getAttribute('src') ?? ''
+    const result = analyticsScriptRegex.exec(candidate)
+    if (result && result[1] && isAllowlistedCDN(result[1])) {
+      src = candidate
     }
   })
-  return cdn
+  return src
+}
+
+/**
+ * The script src we are willing to derive the CDN / write key from:
+ * 1. the tag that actually loaded us (proven by document.currentScript), or
+ * 2. a tag whose derived CDN base is exactly one of our own origins, if (1) is
+ *    unavailable.
+ */
+export const getTrustedScriptSrc = (): string | undefined =>
+  getInitialScriptSrc() ?? getAllowlistedCDNFromScriptTag()
+
+const getCDNUrlFromScriptTag = (): string | undefined => {
+  const src = getTrustedScriptSrc()
+  if (!src) return undefined
+  const result = analyticsScriptRegex.exec(src)
+  return (result && result[1]) || undefined
 }
 
 let _globalCDN: string | undefined // set globalCDN as in-memory singleton
@@ -43,9 +133,10 @@ export const getCDN = (): string => {
   if (cdnFromScriptTag) {
     return cdnFromScriptTag
   } else {
-    // it's possible that the CDN is not found in the page because:
-    // - the script is loaded through a proxy
-    // - the script is removed after execution
+    // it's possible that the CDN is not found because:
+    // - the SDK was loaded via a bundler / npm (no analytics.js script tag)
+    // - the loading tag ran in a context where document.currentScript was null
+    // - the script is loaded through a proxy and removed after execution
     // in this case, we fall back to the default Segment CDN
     return `https://cdn.segment.com`
   }
@@ -64,20 +155,7 @@ export const getNextIntegrationsURL = () => {
 export function getLegacyAJSPath(): string {
   const writeKey = embeddedWriteKey() ?? getGlobalAnalytics()?._writeKey
 
-  const scripts = Array.prototype.slice.call(
-    document.querySelectorAll('script')
-  )
-  let path: string | undefined = undefined
-
-  for (const s of scripts) {
-    const src = s.getAttribute('src') ?? ''
-    const result = analyticsScriptRegex.exec(src)
-
-    if (result && result[1]) {
-      path = src
-      break
-    }
-  }
+  const path = getTrustedScriptSrc()
 
   if (path) {
     return path.replace('analytics.min.js', 'analytics.classic.js')