Defenses: CSP: script-src 'nonce-...' 'self'. <script> tags stripped, event handlers stripped, javascript: stripped. But your input is injected before the page's script tags.
Your input is rendered before the page's scripts. The page loads a relative script. CSP blocks inline scripts but allows 'self'.
CONCEPT: Base Tag Injection
The <base> HTML element specifies the base URL for all relative URLs in a document. If an attacker can inject a <base> tag before the page's own scripts that use relative paths (like src="app.js"), they can redirect those script loads to an attacker-controlled server. This is especially powerful when CSP uses 'self' or 'nonce' — the scripts are "allowed" by CSP since the src attribute doesn't change, but they now load from a different origin. This is why CSP's base-uri directive exists: to prevent <base> injection.