---
title: Avoid `eval` with expressions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid `eval` with expressions
---

# Avoid `eval` with expressions

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ().
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `typescript-node-security/detect-eval-with-expression`

**Language:** TypeScript

**Severity:** Warning

**Category:** Security

**CWE**: [95](https://cwe.mitre.org/data/definitions/95.html)

## Description{% #description %}

The `eval` function could execute malicious code if used with non-literal values. The argument provided to the `eval` method could be use to execute malicious code, if an attacker manage to control the `eval` argument they can execute arbitrary code.

In JavaScript, the `eval()` function evaluates or executes an argument if it's a string of JavaScript code. If this argument is influenced by user input or other external sources, it can lead to security vulnerabilities. Specifically, if an attacker can control or manipulate the value of the `variable` in `eval(variable)`, they can execute arbitrary code.

It is recommended to avoid `eval` at all cost, but if you face an advance use case make sure to use literal values that are under you control or take actions to sanitize the input, even then it is still recommended to avoid the use of `eval` as it has lead to security breaches before.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```typescript
eval(a);
global.eval(a);
globalThis.eval(a);

const answer = eval(expression)
```

## Compliant Code Examples{% #compliant-code-examples %}

```typescript
eval('alert()')
global.eval('a');
globalThis.eval('a');
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}