Dynamic code execution (ARCH3131)

Key typescript.security.dynamic-code-execution · Severity critical · Category security · CWE CWE-95

Running strings as code at runtime with eval or Function leads to remote code execution when user input is involved. Use a data-driven approach instead of dynamic evaluation.

Incorrect

app.get("/calc", (req, res) => {
  const result = eval(req.query.expr as string);
  res.json({ result });
});

Correct

import { evaluate } from "mathjs";

app.get("/calc", (req, res) => {
  const result = evaluate(req.query.expr as string);
  res.json({ result });
});

Fix

Avoid eval/Function; interpret values with a safe parser or an explicit allowlist.