diff --git a/plugins/app-backend/src/lib/config/injectConfigIntoHtml.test.ts b/plugins/app-backend/src/lib/config/injectConfigIntoHtml.test.ts
index f4f2655f1c..56c916fbb9 100644
--- a/plugins/app-backend/src/lib/config/injectConfigIntoHtml.test.ts
+++ b/plugins/app-backend/src/lib/config/injectConfigIntoHtml.test.ts
@@ -67,6 +67,35 @@ describe('injectConfigIntoHtml', () => {
   }
 ]
 </script>
+</head></html>`,
+    });
+  });
+
+  it('should trim script tag endings from injected config', async () => {
+    mockDir.setContent({
+      'index.html.tmpl': '<html><head></head></html>',
+    });
+    await injectConfigIntoHtml({
+      ...baseOptions,
+      appConfigs: [
+        {
+          context: 'mock',
+          data: { x: "</script><script>alert('hi')</script><!-- Hi -->" },
+        },
+      ],
+    });
+    expect(mockDir.content()).toMatchObject({
+      'index.html': `<html><head>
+<script type="backstage.io/config">
+[
+  {
+    "context": "mock",
+    "data": {
+      "x": "><script>alert('hi')> Hi -->"
+    }
+  }
+]
+</script>
 </head></html>`,
     });
   });
diff --git a/plugins/app-backend/src/lib/config/injectConfigIntoHtml.ts b/plugins/app-backend/src/lib/config/injectConfigIntoHtml.ts
index 604b6a8711..c0c1ca200a 100644
--- a/plugins/app-backend/src/lib/config/injectConfigIntoHtml.ts
+++ b/plugins/app-backend/src/lib/config/injectConfigIntoHtml.ts
@@ -55,7 +55,14 @@ export async function injectConfigIntoHtml(
     '</head>',
     `
 <script type="backstage.io/config">
-${JSON.stringify(appConfigs, null, 2)}
+${JSON.stringify(appConfigs, null, 2)
+  // Note on the security aspects of this: We generally trust the app config to
+  // be safe, since control of the app config effectively means full control of
+  // the app. These substitutions are here as an extra precaution to avoid
+  // unintentionally breaking the app, to avoid this being flagged, and in case
+  // someone decides to hook up user input to the app config in their own setup.
+  .replaceAll('</script', '')
+  .replaceAll('<!--', '')}
 </script>
 </head>`,
   );
