CVE-2026-7191: aws qnabot on aws Code Injection

Vulnerability summary

CVE-2026-7191 is a high (CVSS 8.6) Code Injection vulnerability in aws qnabot on aws. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities.

Timeline

1. 27-04-2026
   PublishedVulnerability first disclosed.
2. 28-04-2026
   Last modifiedVulnerability information updated.

Description

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Content Designer interface, which bypasses the intended expression sandbox through JavaScript prototype manipulation. This may grant direct access to backend resources (Lambda environment variables, OpenSearch indices, S3 objects, DynamoDB tables) that are not exposed through normal administrative interfaces. We recommend you upgrade to version 7.3.0 or above.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.