Windsurf Generated Code Using eval() or Function Constructor
Windsurf's Cascade assistant generated JavaScript or TypeScript code that uses eval(), new Function(), or setTimeout/setInterval with string arguments to dynamically execute code. These patterns create severe code injection vulnerabilities that allow attackers to run arbitrary code in your application.
This typically happens when Cascade generates code to parse user input, build dynamic queries, process configuration files, or create flexible template systems. The generated code works correctly but introduces a critical attack surface.
You might discover this during a security audit, when a linter flags eval usage, or when a code review catches the pattern. If deployed to production, any user-controlled input reaching these eval calls could be exploited.
Error Messages You Might See
Common Causes
- Dynamic JSON parsing with eval — Cascade used eval() to parse JSON instead of JSON.parse(), often when handling API responses with complex structures
- String-based computed properties — Generated code uses eval to dynamically access nested object properties instead of bracket notation or lodash.get
- Template string execution — Cascade built a template engine using new Function() to interpolate variables into strings
- Dynamic import construction — Code constructs module import paths using eval rather than dynamic import() expressions
- Math expression evaluation — A calculator or formula feature uses eval() to compute user-entered expressions
How to Fix It
- Search your codebase for eval patterns — Run grep -rn 'eval\|new Function\|setTimeout.*"\|setInterval.*"' src/ to find all instances
- Replace eval(JSON) with JSON.parse() — Every eval() call parsing JSON can be safely replaced with JSON.parse() wrapped in try-catch
- Use bracket notation for dynamic properties — Replace eval('obj.' + path) with a safe property accessor function that splits the path and walks the object
- Install a math expression parser — Replace eval() for math with a safe library like mathjs or expr-eval that only allows mathematical operations
- Add ESLint no-eval rule — Add 'no-eval': 'error' and 'no-new-func': 'error' to your ESLint config to prevent future occurrences
- Implement Content-Security-Policy — Add a CSP header with script-src that excludes 'unsafe-eval' to block eval at the browser level
Real developers can help you.
Prakash Prajapati
I’m a Senior Python Developer specializing in building secure, scalable, and highly available systems. I work primarily with Python, Django, FastAPI, Docker, PostgreSQL, and modern AI tooling such as PydanticAI, focusing on clean architecture, strong design principles, and reliable DevOps practices. I enjoy solving complex engineering problems and designing systems that are maintainable, resilient, and built to scale.
prajwalfullstack
Hi Im a full stack developer, a vibe coded MVP to Market ready product, I'm here to help
Meïr Ankri
Full-stack developer specializing in React / Next.js / Node.js with 6+ years of experience. I've worked across various sectors including automotive (Reezocar/Société Générale), healthcare (Medical Link SaaS), and e-commerce (Glasman). I build web apps end-to-end, from architecture to production, with a focus on scalability, performance, and code quality. I also mentor junior developers and contribute to technical decisions and code reviews.
Antriksh Narang
5 years+ Experienced Dev (Specially in Web Development), can help in python, javascript, react, next.js and full stack web dev technologies.
Basel Issmail
’m a Senior Full-Stack Developer and Tech Lead with experience designing and building scalable web platforms. I work across the full development lifecycle, from translating business requirements into technical architecture to delivering reliable production systems.
My work focuses on modern web technologies, including TypeScript, Angular, Node.js, and cloud-based architectures. I enjoy solving complex technical problems and helping teams turn product ideas and prototypes into working platforms that can grow and scale.
In addition to development, I often collaborate closely with product managers, business analysts, designers, and QA teams to ensure that solutions align with both technical and business goals.
I enjoy working with startups and product teams where I can contribute both as a hands-on engineer and as a technical partner in designing and delivering impactful software.
Dor Yaloz
SW engineer with 6+ years of experience,
I worked with React/Node/Python
did projects with React+Capacitor.js for ios
Supabase expert
Jaime Orts-Caroff
I'm a Senior Android developer, open to work in various fields
legrab
I'll fill this later
Victor Denisov
Developer
PawelPloszaj
I'm fronted developer with 10+ years of experience with big projects. I have small backend background too
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
Why is eval() dangerous even if it works correctly?
eval() executes any string as code. If an attacker can influence the string (through URL parameters, form inputs, database values), they can run arbitrary JavaScript — stealing cookies, accessing APIs, or modifying your page.
Is JSON.parse() always a safe replacement for eval()?
For parsing JSON data, yes. JSON.parse() only parses valid JSON and cannot execute code. Wrap it in try-catch to handle malformed input gracefully.