eval in app code: one input away from code execution
eval and new Function run whatever string you hand them. That is fine for a constant and catastrophic the moment a request value can reach the string, and telling the two apart from the outside is not possible.
What can go wrong
Arbitrary code execution through eval means a string your program builds gets executed as code. eval, new Function, setTimeout with a string body, and the same idea in other languages all take text and run it.
The risk is entirely about where the string comes from:
- Safe:
evalof a hard-coded constant, or a JSON polyfill on an old runtime - Dangerous: any path where a query parameter, form field, or stored value becomes part of the string
Agents reach for eval to "compute this expression the user typed" or "run this rule from the database." Both put user input on the code path.
It happened for real
The math.js library ran user expressions in a sandbox, and researchers escaped it by reaching Function indirectly: Math.floor.constructor("return 1")() compiles and runs arbitrary JavaScript (jwlss.pw math.js writeup). The same constructor trick breaks static-eval, safe-eval, and every "restricted eval" that leaves object constructors reachable (static-eval sandbox escape). The lesson is that a sandbox around eval is not a fix.
How to check yours
Seatbelt flags part of this. The scan is honest about its limit here: it detects that eval or new Function is present in executable app code, not that user input reaches it, because presence-only cannot prove exploitability and eval of a constant is common and safe. So the finding is a soft note that asks you to prove no input reaches it. Bundled library internals are excluded, since you cannot patch a dependency by editing your app.
Ask your agent: "Find every eval, new Function, and string-body setTimeout in our own code, not dependencies. For each, trace the evaluated string back to its source and confirm no user input can reach it."
Manual check: Grep for eval( and new Function(. For each, follow the argument back. If it is anything but a literal you wrote, treat it as a hole.
Fix direction
Replace eval and new Function with direct code or a purpose-built safe parser. If one truly must stay, prove no user input reaches the string and document why.
Paste into your agent: "Remove every eval and new Function from our code. Replace expression evaluation with a real parser that does not use the Function constructor, and direct dispatch for anything that was 'run this string.' Show each before and after."