Which versions of QnABot on AWS are affected by CVE-2026-7191?

AWS QnABot deployments running version 7.2.4 or earlier contain a vulnerability allowing administrators to bypass security controls and access backend systems without authorization.. A patch is available.

How to fix or mitigate CVE-2026-7191?

Within 24 hours, audit all QnABot administrator accounts and document their business justification. Within 7 days, apply patch available per vendor advisory to upgrade QnABot to the latest version beyond 7.2.4. Within 30 days, complete patch deployment, audit CloudTrail for suspicious Content Designer activity, and verify backend Lambda functions have least-privilege IAM policies.

QnABot on AWS CVE-2026-7191

Q: What is the CVSS score of CVE-2026-7191?

CVE-2026-7191 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25921 HIGH

Code Injection (CWE-94)

2026-04-27 AMZN

RCE Node.js AWS Code Injection Qnabot On Aws

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Reachable over the network via the admin web UI (AV:N/AC:L) but requires administrator access (PR:H) and no user interaction; code execution in the Lambda yields full C/I/A impact, scope kept unchanged to match vendor SC/SI/SA:N.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:00 vuln.today

Analysis Generated

Jul 24, 2026 - 05:00 vuln.today

CVSS changed

Apr 27, 2026 - 21:22 NVD

7.2 (HIGH) 8.6 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 20:30 euvd

EUVD-2026-25921

Patch released

Apr 27, 2026 - 20:30 nvd

Patch available

CVE Published

Apr 27, 2026 - 20:08 nvd

HIGH 8.6

DescriptionCVE.org

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Content Designer interface, which bypasses the intended expression sandbox through JavaScript prototype manipulation. This may grant direct access to backend resources (Lambda environment variables, OpenSearch indices, S3 objects, DynamoDB tables) that are not exposed through normal administrative interfaces.

We recommend you upgrade to version 7.3.0 or above.

AnalysisAI

Arbitrary code execution in AWS QnABot on AWS (versions 7.2.4 and earlier) allows an authenticated administrator to break out of the intended expression sandbox by abusing the static-eval npm package. By injecting a crafted conditional chaining expression through the Content Designer interface, an admin escapes the sandbox via JavaScript prototype manipulation and runs code inside the fulfillment Lambda, reaching backend resources not normally exposed. No public exploit has been identified at time of analysis, and EPSS is very low (0.07%), consistent with the SSVC assessment that no exploitation has been observed.

Technical ContextAI

QnABot on AWS is an open-source conversational AI/chatbot solution built on AWS serverless components (Lambda, OpenSearch, S3, DynamoDB). The vulnerability is classic CWE-94 (Improper Control of Generation of Code / code injection). The root cause is the use of the static-eval npm package to evaluate 'conditional chaining' expressions authored in the Content Designer. static-eval is intended to evaluate only static expressions, but it is well known to be bypassable through JavaScript prototype pollution/manipulation - an attacker crafts an expression that walks the prototype chain (e.g. via constructor/Function traversal) to obtain a reference to native code execution primitives, escaping the intended sandbox. The CPE cpe:2.3:a:aws:qnabot_on_aws:*:*:*:*:*:*:*:* identifies the affected component, and the fix (Issue #855) replaced static-eval entirely with a limited custom expression evaluator and additionally scoped the fulfillment Lambda IAM policy to least privilege.

RemediationAI

Vendor-released patch: v7.3.0 - upgrade to QnABot on AWS 7.3.0 or later, which removes static-eval and replaces it with a limited custom expression evaluator (Issue #855) and additionally scopes the fulfillment Lambda IAM policy to least privilege for OpenSearch access. AWS advises deploying to a non-production environment first, as this is a minor/major release with Lambda runtime upgrades (Node.js 24, Python 3.14). Follow the security bulletin at https://aws.amazon.com/security/security-bulletins/2026-020-aws/ and release notes at https://github.com/aws-solutions/qnabot-on-aws/releases/tag/v7.3.0. If immediate upgrade is not possible, compensating controls include tightly restricting who holds Content Designer/administrator access (treat it as equivalent to Lambda code-execution rights), enforcing MFA and least-privilege IAM on admin identities, and manually scoping the fulfillment Lambda's IAM role to least privilege so that even a sandbox escape cannot reach OpenSearch indices, S3 objects, or DynamoDB tables beyond what is strictly required - noting that over-tightening the Lambda role may break legitimate fulfillment workflows and should be tested first.