Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[Abdel-Monaam-Aouini]

Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[wardourdigital]

This was flagged up in my Svelte build V3.

If this is not going to change, would be good to have an explanation as to why this is not considered a security risk.

[benjaminprojas]

I am also getting this same in my Vite/Vue 3 build. Would love an explanation or a fix.

[br-schneider]

I am also having this issue in a Vite/React build that is deploying to Netlify. Any help would be appreciated!

[nik-1236789]

Getting the same issue on vite build, when trying to run on Amplify -> Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[ivkoandrv]

Hello everyone,
Same issue.

[kvengerov]

Hello everyone,
Same issue with highlight.js/lib/languages/wren.js

[hassanmehdi98]

Same issue with React/Vite4 build on local machine

[Abdel-Monaam-Aouini]

[georgesa]

I'm using the solution found here: #289

Replacing import lottie from "lottie-web"; with import lottie from "lottie-web/build/player/lottie_light"; and using renderer: "svg", worked for me.

Edit: no I am not, the SVG renderer is acting weird.

[yoni12ab]

Hi don't know if it is relevant
manage to change 'ExpressionManager.js' so you can pass a function instead of passing function in string,
and run the function instead of eval,
demo:
https://stackblitz.com/edit/typescript-xm1gpw?file=lottie.ts

npm package with the change:
@sentinel-one/lottie-web-no-eval

pr:
https://github.com/airbnb/lottie-web/pull/2998/files#diff-5b04d0c8bca59b39ce8c6631676a283b79119d8e04872b1332d9f0127db51f57

[mat-jaworski]

Any updates on this?

[zachrattner]

I'm also interested in a solution to this.

[aenzenith]

Fix this please.

[kuzeofficial]

any updates??

[zachrattner]

I am curious if @bodymovin or anyone else in the Airbnb/Lottie community could help shed some light on what's going on here.

Lottie is a great tool that enables some delightful animations that are dififcult for any other tool to match, but it looks like it's suffering from some serious neglect as of late. I'm frankly a bit discouraged by the 40+ open pull requests that have been sitting for months, some of them as simple as fixing a typo.

Are the maintainers interested in fixing this issue and it's just a matter of prioritization? Or have the maintainers moved on and even if a fix were to be available, no one would have the bandwidth to review and merge it?

I'm bringing this up as a B2B app with an obligation to review flagged security issues in my software bill of materials. To have an issue like this open for 10 months with no official word on what's going on is concerning.

I'm happy to help and do my part - I or someone on my team can look into reorganizing the code to not depend on eval, but I don't want to spend the time if it'll just result in one more on the stack of open PRs in this project.

[ericklarsen]

same issue here, any updates?

[fscaringi]

up

[Simo-CE]

Same issue in my sveltekit app
"svelte": "^3.54.0",
"lottie-svelte": "^1.3.5"

[dextel2]

Looks like an active issue. bumping in for the updates

[cthier-eb]

Same same

[roger-hermasch]

Same for us - seems like a major security risk regarding 1.7m weekly downloads?!

[danlevison]

Same issue on Vite/React build that I am deploying to Netlify.

[54mu3l]

Same:

node_modules/lottie-web/build/player/lottie.js (17010:32) Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

using Quasar/Vue.js/Vite with vue3-lottie which depends on lottie-web version 5.12.2

[amantiwari1]

same issue on vite/vue-ts

[PainterPuppets]

Same issue

[tawanaj]

Seeing the same issue here with a vite/react build

[mchughbri]

Replacing the line in /build/player/lottie.js fixes it:

var expression_function = eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0];
with

var expression_function = (new Function('scoped_bm_rt', val + ';return $bm_rt;'))();

[nireld]

+1

[keriat]

+1

[okadots]

Yep same problem with vite 4.1.1

Switching to lottie-light causes issues with color transitioning/rendering for us.

[iZhangHao1997]

+1

[eynomr]

same here

[gitVasile]

Same here

[ejirocodes]

I got a workaround by adding these configs to my compiler options in tsconfig.json

 "compilerOptions": {
    "moduleResolution": "node", 
    "resolveJsonModule": true,
  },

[jorisw]

I got a workaround by adding these configs to my compiler options in tsconfig.json

 "compilerOptions": {
    "moduleResolution": "node", 
    "resolveJsonModule": true,
  },

Could you elaborate how this helps? Does this suppress the error or solve/work around the issue?

[Tokkkyo]

Same issue here. Vite as bundler.
"name": "three-stdlib", "version": "2.29.11",

[muba00]

I have exact same issue 🥇

[rightup]

The same issue, using (vue3-lottie)

node_modules/lottie-web/build/player/lottie.js (17010:32) Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[georgiosApo]

Same issue using react built with vite.

node_modules/lottie-web/build/player/lottie.js (17010:32) Use of eval in "node_modules/lottie-web/build/player/lottie.js" is strongly discouraged as it poses security risks and may cause issues with minification.

[VsevolodKurochka]

+1

[k3vin-batista]

+1

[KearseTrevor]

Same here, lit environment

[aminrzaei]

Same problem, Using Vite

[cf-dlangston]

Thanks for the tip 🙏 @mchughbri, this worked for me!

Replacing the line in /build/player/lottie.js fixes it:

var expression_function = eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0]; with

var expression_function = (new Function('scoped_bm_rt', val + ';return $bm_rt;'))();

I worked around this as a part of my build process by using vite-plugin-filter-replace. For anyone else who encounters this issue my vite.config.ts looks like:

import filterReplace from 'vite-plugin-filter-replace';

export default defineConfig(({ mode }) => {
  return {
    plugins: [
      // Workaround warning with lottie - https://github.com/airbnb/lottie-web/issues/2927
      filterReplace([
        {
          filter: ['node_modules/lottie-web/build/player/lottie.js'],
          replace: {
            from: 'eval(\'[function _expression_function(){\' + val + \';scoped_bm_rt=$bm_rt}]\')[0]',
            to: '(new Function(\'scoped_bm_rt\', val + \';return $bm_rt;\'))()'
          }
        }
      ]),
    ],
})

I see @yoni12ab opened PR #2998 to address this but their hasn't been any movement there in a year. 🤷

[mrlika]

The workaround above doesn't work for me. But this similar and more complex workaround works for all animations we use:

import { defineConfig } from 'vite';
import filterReplace from 'vite-plugin-filter-replace';

const lottieScopeVariables = [
  'value',
  'content',
  'loopOut',
  'numKeys',
  '$bm_mul',
  '$bm_sum',
  '$bm_sub',
  '$bm_div',
  '$bm_mod',
  '$bm_isInstanceOfArray',
  '$bm_transform',
  'anchorPoint',
  'time',
  'velocity',
  'inPoint',
  'outPoint',
  'width',
  'height',
  'name',
  'loop_in',
  'loop_out',
  'smooth',
  'toComp',
  'fromCompToSurface',
  'toWorld',
  'fromWorld',
  'mask',
  'position',
  'rotation',
  'scale',
  'thisComp',
  'active',
  'wiggle',
  'loopInDuration',
  'loopOutDuration',
  'comp',
  'lookAt',
  'easeOut',
  'easeIn',
  'ease',
  'nearestKey',
  'key',
  'text',
  'textIndex',
  'textTotal',
  'selectorValue',
  'framesToTime',
  'timeToFrames',
  'sourceRectAtTime',
  'substring',
  'substr',
  'posterizeTime',
  'index',
  'globalData',
  'frames',
  '$bm_neg',
  'add',
  'clamp',
  'radians_to_degrees',
  'degreesToRadians',
  'degrees_to_radians',
  'normalize',
  'rgbToHsl',
  'hslToRgb',
  'linear',
  'random',
  'createPath',
  '_lottieGlobal',
  'transform',
  'effect',
  'thisProperty',
  'loopIn',
  'fromComp',
  'thisLayer',
  'valueAtTime',
  'velocityAtTime',
];

// https://vitejs.dev/config/
export default defineConfig({
  plugins: [
    // workaround for a warning with lottie https://github.com/airbnb/lottie-web/issues/2927
    filterReplace([
      {
        filter: ['node_modules/lottie-web/build/player/lottie.js'],
        replace: {
          from: "eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0]",
          to: `
          function _expression_function() {
            var valToEval = val;
            scoped_bm_rt = (new Function(
              'valToEval', ${lottieScopeVariables.map((v) => `'${v}'`).join(',')},
              'try {'
                + val + \`;
                return $bm_rt;
              } catch (e) {
                console.error("Error in lottie-web workaround. Fix the issue in vite.config.ts:", e, "Failed expression:", valToEval);
                throw e;
              }\`
            ))(valToEval, ${lottieScopeVariables.join(',')});
          }`,
        },
      },
    ]),
  ],
});

[ulysse-lacour]

Same problem using Vite

[ZoomlyNate]

I'm experiencing essentially the same issue with a slightly different path:

node_modules/@lottiefiles/react-lottie-player/dist/lottie-react.esm.js (15:263172): Use of eval in "node_modules/@lottiefiles/react-lottie-player/dist/lottie-react.esm.js" is strongly discouraged as it poses security risks and may cause issues with minification.

I tried the above workarounds, adding a filterReplace plugin to my vite.config.ts file, and altered the path to match that from my error message, however neither of the above workarounds worked for me.

[mrlika]

In your case problem is in @lottiefiles/react-lottie-player/dist/lottie-react.esm.js. It is a different minified file with lottie-web bundled into it. Workaround is for lottie-web package and not for @lottiefiles.

You can try changing
1.
node_modules/lottie-web/build/player/lottie.js to
node_modules/@lottiefiles/react-lottie-player/dist/lottie-react.esm.js

"eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0]" to
'eval("[function _expression_function(){"+val+";scoped_bm_rt=$bm_rt}]")[0]'

it will probably work.

[Spudisis]

+1

[imransilvake]

same issue in Vite build

[wardboston]

Same Issues with React

[gustavo-bordin]

Same issue on building a chrome extension with svelte, although the solution of importing lottie_light works, would be good to have a proper solution

[JustFly1984]

Replacing the line in /build/player/lottie.js fixes it:

var expression_function = eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0]; with

var expression_function = (new Function('scoped_bm_rt', val + ';return $bm_rt;'))();

@mchughbri Sorry but how is new Function is less vulnerable than eval, if it is the same thing???
Please do not advise this ever!

[mrlika]

Replacing the line in /build/player/lottie.js fixes it:
var expression_function = eval('[function _expression_function(){' + val + ';scoped_bm_rt=$bm_rt}]')[0]; with
var expression_function = (new Function('scoped_bm_rt', val + ';return $bm_rt;'))();

@mchughbri Sorry but how is new Function is less vulnerable than eval, if it is the same thing??? Please do not advise this ever!

It is not stated that this fix removes possible vulnerabilities. It supresses annoying warnings.

On the other hand, eval in Lottie Web usually evaluates JS from hardcoded resources (e.g., predefined animations). Because of this, you will rarely see vulnerabilities related to eval in Lottie Web other than the supply chain security issues.

[JustFly1984]

@mrlika The bad warning is better than silent vulnerability, even if it is annoying. It could be supply chain attack, and it could be abused to execute user input.