Any language that allows you to easily evaluate a string as a line of code carries security risks. In this regard, NodeJS is no worse than anything written in Javascript or PHP.
Even if you write your code in Java or ASP, a naive web programmer may still suffer from SQL injection injections if they are not careful, and pasting code is only one way that an application can be compromised.
, , eval .