Performing evals is a core part of the design. Take a look at the additional notes section on this documentation of the .html method. http://api.jquery.com/htm

Performing evals is a core part of the design. Take a look at the additional notes section on this documentation of the .html method. http://api.jquery.com/html/ http://api.jquery.com/html/ >By design, any jQuery constructor or method that accepts an HTML string — jQuery(), .append(), .after(), etc. — can potentially execute code This makes jQuery less safe in general, but I think the CSP restrictions this puts in place are probably a greater issue for most people. I’ve been involved in retro-fitting strict CSPs into a few projects, and more than once I’ve been thwarted by very minor use of jQuery in a couple of places.