Oh, this was just to make me smile. You can intercept the XHR that submits your solution, then change the code.

I have found an xss flaw in the way that the editor renders. It's a serious security risk. I've emailed the find to info@codewars.com. If you would like for me to help show how this could be used to perform a malicious attack on the site, please email me back at: dan dot andrew dot price at gmail dot com. I don't believe sharing the attack vector on here, or on Github would be wise (as then anyone could use it to hack codewars).

‘For JavaScript, both eval and Function are disabled.’

Ah-ha!
… Challenge accepted …

var calc = function (expression) {
return child_process.execSync(node -e "console.log(${expression})").toString()*1;
};

Attempting this Kata in JS. It appears that some of the test cases' lines are prepended with tab characters ('\u000B') but some are not. I can't see anything stating that these must be added in the description, and it appears that one of the two encoding test cases use them, hence making it very hard to solve. Am I missing something?