---
title: Business Rules Using Eval Function
description: "Impact Area Security Severity High Affected Element Business rules ## Rule number **SN-0027** ## Impact The `eval()` function evaluates or executes an argument. Improper use of `eval()` opens up your code for injection attacks and debugging can be more challenging, as no line numbers…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/servicenow-rules/business-rules-using-eval-function/"
updated: "2025-03-21"
category: Rules
---

# Business Rules Using Eval Function

Impact Area       Security           Severity

High

           Affected Element

Business rules

## Rule number

**SN-0027**

## Impact

The `eval()` function evaluates or executes an argument. Improper use of `eval()` opens up your code for injection attacks and debugging can be more challenging, as no line numbers are displayed with an error.

## Remediation

Avoid the use of eval. It encourages the use of non trusted code. If you must execute arbitrary code, use `GlideScriptEvaluator` which ensures it came from a record.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection)](https://cwe.mitre.org/data/definitions/95.html).