eval() executes arbitrary code and is a common attack vector.
Remove eval(). Use JSON.parse() for data or refactor to avoid dynamic code execution.