As B-Con mentioned, the attacker is not the one sitting at the computer so could be using the eval() already in your script as a means to pass malicious code to your site in order to exploit the current user's session in someway (e.g. a user following a malicious link).
The danger of eval() is when it is executed on unsanitised values, and can lead to a DOM Based XSS vulnerability.
e.g. consider the following code in your HTML (rather contrived, but it demonstrates the issue I hope)
<script>
eval('alert("Your query string was ' + unescape(document.location.search) + '");');
</script>
Now if the query string is ?foo you simply get an alert dialog stating the following: Your query string was ?foo
But what this code will allow a user to do is redirect users from their site to a URL such as http://www.example.com/page.htm?hello%22);alert(document.cookie+%22, where www.example.com is your website.
This modifies the code that is executed by eval() to
alert("Your query string was hello");
alert(document.cookie+"");
(New lines added by me for clarity). Now this could be doing something more malicious than showing the current cookie value, as the required code is simply passed on the query string by the attacker's link in encoded form. For example, it could be sending the cookie to the attacker's domain in a resource request, enabling the authentication session to be hijacked.
This applies to any value from user/external input that is unsanitised and executed directly in the eval(), not just the query string as shown here.
eval. The "eval is evil" is probably never said today by experienced coders. If you're stupid, it may be dangerous. But usually it's just slow, ugly and leading to hard to evolve code.eval. I told it (read my comment to the end). My point is that "eval is evil" might be a fun slogan but isn't a useful take. BTW it could be argued that JS did change a little since 2013 so trying to revive and debate an old conversation is probably best left to historians.Functionshould only be used with care as well. If possible, a JSON-parser or similar should be used instead. There is also a more recent thread discussing this topic that might be of interest for anyone ending up here.