CodeVetter · local evidence export

Arbitrary code execution via eval() in JavaScript

codevetter-public-benchmark/js-eval-injection

detected · high confidence

Verification

Code reviewcompleted

Qualified static finding recorded.

Executable testnot verified

No exact-current runtime evidence is included.

Audiencenot run

No audience validation occurred.

Finding

highbenchmark ground truth

code injection

Caller-supplied expression is passed directly to eval(), turning any user-controlled value into executing JavaScript and enabling arbitrary code execution.

source.js:7