Remove unsafe-eval and unsafe-inline from script-src | Community
Skip to main content

Remove unsafe-eval and unsafe-inline from script-src

  • Sep 23, 2025 9:15 AM UTC
  • 7 replies
  • 1160 views

Hello,

Based on the documentation (https://www.intercom.com/help/en/articles/3894-using-intercom-with-content-security-policy), it appears that both unsafe-inline and unsafe-eval need to be added to our Content Security Policy in order for the JavaScript widget to function.

From a security perspective, this raises serious concerns, as it increases the attack surface. Our reporting endpoint shows that unsafe-inline isn’t actually required by your code, but unsafe-eval is being triggered in the vendors-app-modern.js file at the following line:

var mod = eval("quire".replace(/^/, "re"))(moduleName);

Is there any way to eliminate this eval call? If not, we may need to reconsider our use of Intercom due to these security implications.

Best regards,

Salim

Sep 26, 2025 1:26 PM UTC

Hey there ​@Salim Semaoune, Emily here from Support Engineering at Intercom 👋🏼

 

You are correct that Intercom currently requires the use of unsafe-eval in your Content Security Policy for the Messenger widget to function. This is due to how the Intercom Messenger is loaded, and at present, there is no way to eliminate this requirement or the associated eval call in the code.

Intercom acknowledges that this is not ideal from a security perspective and understands concerns about increasing the attack surface. The security and product teams are aware of the issue and are considering ways to move away from unsafe-eval to better support strict CSP setups, but there unfortunately is no active solution as of yet. It is on our radar and we hope to make some progress on this soon.

 

If your reporting shows that unsafe-inline is not required, you may omit it, but unsafe-eval remains necessary for now.

    7 replies

    Emilygav
    Intercom Team
    Forum|alt.badge.img+6
    • EmilygavIntercom Team
    • Intercom Team
    • Sep 26, 2025 1:26 PM UTC

    Hey there ​@Salim Semaoune, Emily here from Support Engineering at Intercom 👋🏼

     

    You are correct that Intercom currently requires the use of unsafe-eval in your Content Security Policy for the Messenger widget to function. This is due to how the Intercom Messenger is loaded, and at present, there is no way to eliminate this requirement or the associated eval call in the code.

    Intercom acknowledges that this is not ideal from a security perspective and understands concerns about increasing the attack surface. The security and product teams are aware of the issue and are considering ways to move away from unsafe-eval to better support strict CSP setups, but there unfortunately is no active solution as of yet. It is on our radar and we hope to make some progress on this soon.

     

    If your reporting shows that unsafe-inline is not required, you may omit it, but unsafe-eval remains necessary for now.

    • Salim Semaoune
    • Author
    • New Participant
    • Sep 29, 2025 9:36 AM UTC

    Hey ​@Emilygav 

    It looks like the call to eval is made by the underlying dependency to protobufjs. If that’s correct, a fix has been issued in the version 7.5.0 of the library https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.0

    but it’s still not functional as the release process has failed: https://github.com/protobufjs/protobuf.js/issues/2094

    It could be cool if someone at Intercom could help on the issue so that it’s solved faster.

    Thank’s in advance

    Hi team, throwing in another vote for this issue to be looked at. Thanks.

    ​@Emilygav  This is fixed in protobufjs 8.0.0, please ask your developers to update this dependency so we can move on.

    Hello

    protobufjs 8.0 fixed this over a year ago                
                                                                                                                                                                                        We're a SaaS platform and we've invested significant engineering effort to remove unsafe-eval from our CSP so we can move to enforced mode. Intercom is now the only blocker preventing us from  enforcing our Content Security Policy.
                                                                                                                                                                
     The root cause has been identified: your dependency on protobufjs, which uses eval() internally. protobufjs 8.0.0 shipped a fix for this — it no longer requires eval. This means the fix on Intercom's side is literally a dependency update.

    Could someone from the Intercom team please provide a timeline for updating protobufjs and removing the eval() dependency? This is a security requirement for us, not a nice-to-have.

     Thanks.

    • Nolan
    • New Participant
    • May 8, 2026 9:09 PM UTC

    Any updates on this? 

    Intercom Team
    Forum|alt.badge.img+7

    Hi All, Seán here from the Fin technical support team stepping in 👋

    Sorry for the slow answer. The eval call you found in the Messenger was removed in January 2026. We patched the small dependency that contained it. The call no longer exists in the scripts we ship today.

    Upgrading protobufjs would not have fixed it, because the call sat in a separate helper package. We patched that package directly.

    Our help article still lists 'unsafe-eval' in the example strict policy. That is out of date, and we are asking for it to be reviewed. Until then, please test the Messenger with a Report-Only policy that leaves out 'unsafe-eval' before you enforce it. If your report still shows a violation from an Intercom script, send us the blocked URL, the source file and the line number. We will investigate right away. Thanks so much for flagging this with us we really appreciate feedback like this!

    Terms & ConditionsAccessibility statement