fixed eval security hole