CVE-2026-7191CWE-94

Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS

High · published April 27, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Content Designer interface, which bypasses the intended expression sandbox through JavaScript prototype manipulation. This may grant direct access to backend resources (Lambda environment variables, OpenSearch indices, S3 objects, DynamoDB tables) that are not exposed through normal administrative interfaces.

We recommend you upgrade to version 7.3.0 or above.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00737 · 54.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-04-27T20:08Z
EPSS history
Timeline
  • 27 APR 20:08Z
    Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS
    cvelistv5