Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[Abdel-Monaam-Aouini]

Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[wardourdigital]

This was flagged up in my Svelte build V3.

If this is not going to change, would be good to have an explanation as to why this is not considered a security risk.

[benjaminprojas]

I am also getting this same in my Vite/Vue 3 build. Would love an explanation or a fix.

[br-schneider]

I am also having this issue in a Vite/React build that is deploying to Netlify. Any help would be appreciated!

[nik-1236789]

Getting the same issue on vite build, when trying to run on Amplify -> Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[ivkoandrv]

Hello everyone, Same issue.

[kvengerov]

Hello everyone, Same issue with highlight.js/lib/languages/wren.js

[hassanmehdi98]

Same issue with React/Vite4 build on local machine

[Abdel-Monaam-Aouini]

[GeorgeSA]

I'm using the solution found here: https://github.com/airbnb/lottie-web/issues/289

Replacing import lottie from "lottie-web"; with import lottie from "lottie-web/build/player/lottie_light"; and using renderer: "svg", worked for me.

Edit: no I am not, the SVG renderer is acting weird.

[yoni12ab]

Hi don't know if it is relevant manage to change 'ExpressionManager.js' so you can pass a function instead of passing function in string, and run the function instead of eval, demo: https://stackblitz.com/edit/typescript-xm1gpw?file=lottie.ts

npm package with the change: @sentinel-one/lottie-web-no-eval

pr: https://github.com/airbnb/lottie-web/pull/2998/files#diff-5b04d0c8bca59b39ce8c6631676a283b79119d8e04872b1332d9f0127db51f57

[mat-jaworski]

Any updates on this?

[zachrattner]

I'm also interested in a solution to this.

[aenzenith]

Fix this please.

[kuzeofficial]

any updates??

[zachrattner]

I am curious if @bodymovin or anyone else in the Airbnb/Lottie community could help shed some light on what's going on here.

Lottie is a great tool that enables some delightful animations that are dififcult for any other tool to match, but it looks like it's suffering from some serious neglect as of late. I'm frankly a bit discouraged by the 40+ open pull requests that have been sitting for months, some of them as simple as fixing a typo.

Are the maintainers interested in fixing this issue and it's just a matter of prioritization? Or have the maintainers moved on and even if a fix were to be available, no one would have the bandwidth to review and merge it?

I'm bringing this up as a B2B app with an obligation to review flagged security issues in my software bill of materials. To have an issue like this open for 10 months with no official word on what's going on is concerning.

I'm happy to help and do my part - I or someone on my team can look into reorganizing the code to not depend on eval, but I don't want to spend the time if it'll just result in one more on the stack of open PRs in this project.

[ericklarsen]

same issue here, any updates?

[fscaringi]

up

[Simo-CE]

Same issue in my sveltekit app "svelte": "^3.54.0", "lottie-svelte": "^1.3.5"

[dextel2]

Looks like an active issue. bumping in for the updates

[cthier-eb]

Same same

[roger-hermasch]

Same for us - seems like a major security risk regarding 1.7m weekly downloads?!

[danlevison]

Same issue on Vite/React build that I am deploying to Netlify.

[54mu3l]

Same:

node_modules/lottie-web/build/player/lottie.js (17010:32) Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

using Quasar/Vue.js/Vite with vue3-lottie which depends on lottie-web version 5.12.2

[amantiwari1]

same issue on vite/vue-ts

[PainterPuppets]

Same issue

[tawanaj]

Seeing the same issue here with a vite/react build

[mchughbri]

Replacing the line in /build/player/lottie.js fixes it:

var expression_function = eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0]; with

var expression_function = (new Function('scoped_bm_rt', val + ';return $bm_rt;'))();

[jorisw]

Apparently the supported way to work around this is by importing directly from a Lottie-light file:

Replacing import lottie from "lottie-web"; with import lottie from "lottie-web/build/player/lottie_light"; and using renderer: "svg", worked for me.

[SabiQG]

Same issue on vite build

[Sunny264]

Haven't it been resolved yet