Unsafe dynamic code execution
CriticalAV-RUNTIME-005Runtime safetyCore pack
What it finds
`eval(`, `new Function(`, `Function('...')`, or `__import__('...')`.
Why it matters
Dynamic code evaluation collapses the boundary between data and code — if any evaluated content is influenced by model output, it becomes arbitrary code execution.
How to fix it
Remove dynamic evaluation; if scripting is required, use a sandboxed, resource-limited interpreter.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- UNSAFE_EVAL_EXEC
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- JavaScript/TypeScript/Python source
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High
- Unsandboxed browser automationAV-RUNTIME-008 · High