eval is by far the easiest way to run arbitrary code, but you can write eval yourself in any fully-general programming language. It doesn't actually give attack

eval is by far the easiest way to run arbitrary code, but you can write eval yourself in any fully-general programming language. It doesn't actually give attackers any additional power. This isn't the eval attack where you accidentally pass attacker-controlled inputs into eval because of an escaping problem or something, the sole purpose of /run is to allow users to run arbitrary Lua in the UI