← all rules
code/js-eval
Use of eval() with dynamic input
What it detects
eval() executes arbitrary code. If the argument is influenced by user input, this is RCE. Avoid eval entirely.
How it runs
Applied line-by-line via a tagged regex with language-specific gating. Comments are skipped. Designed for high-confidence patterns where AST parsing would be overkill.
Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.