eval / dynamic exec on user input

What it is

eval, new Function, vm.runInNewContext, or a shell exec is called with a string that includes request input.

Why it matters

This is arbitrary code execution with your process's privileges. There is no partial version of this vulnerability — whoever controls the input controls the server.

How to fix it

Remove the dynamic execution. Parse structured input with JSON.parse, dispatch through a lookup table of known handlers, and use execFile with an argument array rather than a shell string.