CVE-2026-7191

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7191
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7191.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7191
Published
2026-04-27T20:08:30Z
Modified
2026-08-29T11:47:17Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS
Details

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Content Designer interface, which bypasses the intended expression sandbox through JavaScript prototype manipulation. This may grant direct access to backend resources (Lambda environment variables, OpenSearch indices, S3 objects, DynamoDB tables) that are not exposed through normal administrative interfaces.

We recommend you upgrade to version 7.3.0 or above.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7191.json"
}
References

Affected packages

Git / github.com/aws-solutions-library-samples/qnabot-on-aws

Affected ranges

Type
GIT
Repo
https://github.com/aws-solutions-library-samples/qnabot-on-aws
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cb7bf681de876d4e03e01653970d152fc97083a9
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.2.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.3
4.*
4.6.0
4.7.3
v1.*
v1.0
v1.1
v2.*
v2.0
v2.0.1
v2.2.0
v5.*
v5.0.0
v5.0.1
v5.1.0
v5.1.1
v5.1.2
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6
v5.2.7
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.5.0
v5.5.1
v5.5.2
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v7.0.7
v7.1.0
v7.1.1
v7.1.2
v7.1.3
v7.2.0
v7.2.1
v7.2.2
v7.2.3
v7.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7191.json"