Using eval()
in JavaScript code is very risky and could easily lead to XSS vulnerabilities. It's best to not use it at all, and seeing it in production code is certainly a sign that there may be vulnerabilities.
However, just finding the function does not mean that you have found an XSS vulnerability. For the site to be vulnerable, you must somehow manage to pass user input (such as a query parameter, a form field, something you can get saved into the database...) into the function. If you manage to do that, you have found a "real" XSS vulnerability, and not just a "self" one.
If you can only get code to execute from the console, it's not a real PoC and I wouldn't bother reporting it to anyone. If you are writing in the console, you can already execute arbitrary code and you don't need the eval
function.