evals

Reports uses of the eval function.

✅ This rule is included in the ts logical and logicalStrict presets.

The eval() function evaluates a string as JavaScript code. This is dangerous because it can execute arbitrary code, potentially leading to security vulnerabilities.

Using eval() has several problems:

• Security risks: executing untrusted code can lead to code injection attacks
• Performance issues: eval() prevents JavaScript engine optimizations
• Debugging difficulty: dynamically executed code is harder to debug and trace
• CSP violations: many Content Security Policies prohibit eval()

Examples

❌ Incorre

AEconsB0coAE <= sp ansty="le--0:#82AAFF;--1:#3B61">B0getUserInp53(<);d ivclassNa="meec-li">B0ev53(code<);d ivclassNa="meco"><);d>AEconsB0resuAE <= sp ansty="le--0:#82AAFF;--1:#3B61">B0ev5<3(sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">4D2 +< 2sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<);d ivclassNa="meco"><);d>

44AEco61B044A1<111' spans="tyle--0:#ECC48D;--1:#98">4E4D{"name": "Jo1<111' spans="tyle--0:#D6DEEB;--1:#40">344AEco61B<0obj spans="tyle--0:#C792EA;--1:#88">44A61B04<4AE. spans="tyle--0:#82AAFF;--1:#3B">61B0p3F53(da<;di vdivclass="Nameexpressive-">44AEco61B0calcu44A1<111( spans="tyle--0:#D7DBE0;--1:#40">364<4AE spans="tyle--0:#C5E478;--1:#3B">61B0nu44364<4AE spans="tyle--0:#C5E478;--1:#3B">61B0nu1<111) spans="tyle--0:#C792EA;--1:#88">44AE< => spans="tyle--0:#D6DEEB;--1:#40">3 >44A3F<53b ;divclass="Nameec-">44AEco61B0re44A61B0calcu30<9822 spans="tyle--0:#C792EA;--1:#88">440<9822 spans="tyle--0:#D6DEEB;--1:#40">3F<53) ;divclass="Name">< 2)>

Options

This rule is not configurable.

When Not To Use It

In rare cases, eval() may be necessary for dynamic code execution, such as in development tools or REPLs. If you have a legitimate use case and understand the security implications, you may disable this rule for specific lines. Consider using the Function constructor as a slightly safer alternative, though it still carries risks.

Further Reading

• MDN: eval()
• MDN: Never use direct eval()

Equivalents in Other Linters

• Biome: noGlobalEval
• Deno: no-eval
• ESLint: no-eval
• Oxlint: eslint/no-eval