I just saw a youtube content about the eval() function and read some stuffs about eval() in google. I can see eval() is pretty useful to use evaluate strings to js code. But they say that using eval() is "evil" and dangerous and I don't get it why.
eval() function evaluates codes passed to it as an arguement, for example
Would alert('hello'), since alert("hello") is not malicious, an attacker who knows more about wrtiting malicious code can replace alert("hello") with something else causing damages to the website.
Eval is considered risky and harmful. It is slow, and can contain malicious code like infinite loops, XSS(cross site scripting) attacks etc.
It should be never used or only in very specific secured applications.
Personally I disable it in Content-Security-Policy(CSP) so it is not possible to use it.