Unsafe Statement
April 24, 2026 · View on GitHub
| Code | Severity | i18n | Experimental |
|---|---|---|---|
| unsafe-stmt | Warning | sast_warnings.unsafe_stmt | ❌ |
Introduction
Warning about the usage of eval() or Function() in the source code. Their use is not recommended and can be used to execute insecure code (for example to retrieve the globalThis / window object).
Example
The warning value can be either Function or eval.
{
"kind": "unsafe-stmt",
"location": [[49,37],[49,62]],
"value": "Function",
"file": "index.js"
}
Example of a dangerous code that an attacker may use:
const xxx = Function("return this")();
// xxx is equal to globalThis
console.log(xxx);