They don't return code that run JavaScript. All code is executed on the server and only a string of the result is returned. For web courses, evaluation is done client-side and is properly sandbox. See [1] to learn more about the client-side sandboxing.

[1] https://github.com/Codecademy/stuff.js