[security] M-18: eval() of table expressions with user_dict access

[jacobyoby]

Severity: Medium
File: util.py:8221-8302

Problem

eval() of table expressions has access to user_dict, potentially allowing data exfiltration or manipulation.

Remediation

Restrict the evaluation context. Consider using a safer expression evaluator.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.