eval() with user input allows arbitrary Python code execution.
Remove eval(). Use ast.literal_eval() for safe expression parsing of known data structures.