From 6b775a101169881cae2fed50536f35fd000eb3dd Mon Sep 17 00:00:00 2001
From: Alan Agius <17563226+alan-agius4@users.noreply.github.com>
Date: Tue, 4 Aug 2026 07:59:28 +0000
Subject: [PATCH] fix(@angular/cli): mitigate package self-referencing in local
 CLI resolution

Instead of resolving `@angular/cli` when bootstrapping the local CLI, we resolve `@angular/cli/lib/cli/index.js`. This ensures that Node.js only resolves the local CLI if the specific directory structure exists inside `node_modules`, preventing unintended package self-reference resolutions outside of `node_modules`.
---
 packages/angular/cli/lib/init.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/packages/angular/cli/lib/init.ts b/packages/angular/cli/lib/init.ts
index cd324b6df69b..191ee00456db 100644
--- a/packages/angular/cli/lib/init.ts
+++ b/packages/angular/cli/lib/init.ts
@@ -49,9 +49,13 @@ let forceExit = false;
 
   try {
     // No error implies a projectLocalCli, which will load whatever
-    // version of ng-cli you have installed in a local package.json
+    // version of ng-cli you have installed in a local package.json.
     const cwdRequire = createRequire(process.cwd() + '/');
-    const projectLocalCli = cwdRequire.resolve('@angular/cli');
+    // Instead of resolving `@angular/cli`, we resolve `@angular/cli/lib/cli/index.js`.
+    // This ensures that Node.js can only resolve the path if the specific folder
+    // structure exists in `node_modules`, and it will not be resolved if the
+    // directory structure is outside of `node_modules` (e.g., package self-referencing).
+    const projectLocalCli = cwdRequire.resolve('@angular/cli/lib/cli/index.js');
     cli = await import(projectLocalCli);
 
     const globalVersion = new SemVer(VERSION.full);