eval() or exec() with a dynamic argument

What it detects

eval() or exec() with a dynamic argument: an injection check run by the semgrep analyzer.

Evidence

The Semgrep source location, rule identity, and bounded match context normalized into Fendix evidence.

Remediation

eval()/exec() with dynamic argument — code injection risk. Avoid eval/exec entirely. If required, validate input strictly against an allowlist before execution.

Limitations

This check is limited to the applicability and evidence delivered by semgrep. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.

Related reference

Analyzer Registry · Findings and release decisions · Policy and confidence

Remediation guidance: Remediation and fix verification · Baselines and suppressions