CVE-2026-7191

unknowncovered by 1 sourcefirst seen 2026-06-05

Bulletin ID: 2026-020-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/04/27 13:15 PM PDT Description: QnABot on AWS is an open-source solution that provides a multi-channel, multi-language conversational interface powered by Amazon Lex, Amazon OpenSearch Service, and optionally Amazon Bedrock. We identified CVE-2026-7191, where the improper use of the static-eval npm package may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context. By injecting a crafted conditional chaining expression via the Content Designer interface, an actor with Admin access could bypass the intended expression sandbox through JavaScript prototype manipulation. Successful exploitation may grant direct access to backend resources, including Lambda environment variables, OpenSearch indices, S3 objects, and DynamoDB tables, that are not exposed through normal administrative interfaces. Impacted versions: <=7.2.4 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

What: Improper use of the static-eval npm package may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context.
Who is affected: Authenticated administrators of QnABot on AWS.
Urgency: Remediation is urgent due to the risk of arbitrary code execution and access to backend resources.
Action: Review and secure the use of the static-eval npm package.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-7191

Get an email if CVE-2026-7191 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-7191- Arbitrary Code Execution via Sandbox Bypass in QnABot on AWSaws · 2026-06-05

External references

NVD record for CVE-2026-7191

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-7191 status](https://www.csirts.com/badge/CVE-2026-7191)](https://www.csirts.com/cve/CVE-2026-7191)