I found eval() in the JavaScript code of a site in HackerOne.

I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a JavaScript alert. The alert executed.

The company states that they are not interested in self-XSS. Is eval() considered self-XSS?

  • it depends on the string passed to eval(). if it's site-provided, there's no more risk then there would be running the js directly. in fact, all js uses eval to execute script tags... if it's not from a different site, it's not XSS by definition. – dandavis Mar 29 '19 at 19:56

Self-XSS means XSS'ing yourself by running things in console, or stored XSS in an area that only affects the user that injected the XSS. Based on your comments it sounds like you've found self-XSS, since in order to exploit it you have to enter browser console commands.

The reason that entering console commands doesn't count as a vulnerability is that every website is vulnerable to that - you don't need code in the page to use eval or anything like that in order to write a malicious payload into the console and run it.


Using eval() in JavaScript code is very risky and could easily lead to XSS vulnerabilities. It's best to not use it at all, and seeing it in production code is certainly a sign that there may be vulnerabilities.

However, just finding the function does not mean that you have found an XSS vulnerability. For the site to be vulnerable, you must somehow manage to pass user input (such as a query parameter, a form field, something you can get saved into the database...) into the function. If you manage to do that, you have found a "real" XSS vulnerability, and not just a "self" one.

If you can only get code to execute from the console, it's not a real PoC and I wouldn't bother reporting it to anyone. If you are writing in the console, you can already execute arbitrary code and you don't need the eval function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.