Daily security quiz #15

A new question every day. Read the code and pick the most serious security vulnerability.

This calculator evaluates mathematical expressions. An expression can be filled in using a shared link (?expr=1%2B2). What is the most serious vulnerability?

1const input = document.querySelector('#expr');
2const out = document.querySelector('#out');
3input.value = new URLSearchParams(location.search).get('expr') ?? '';
4 
5document.querySelector('#calc').addEventListener('click', () => {
6  out.textContent = eval(input.value);
7});

1. ADividing by 0 produces Infinity
2. BinnerHTML should be used instead of textContent
3. CDecimal calculations produce rounding errors
4. DA value received from the URL is executed with eval, allowing arbitrary scripts to run in the browser of anyone who opens an attacker-created link and clicks Calculate (XSS)