The vulnerability CVE-2026-7191 affects AWS QnABot on AWS versions 7.2.4 and earlier due to improper use of the static-eval npm package. An authenticated administrator can inject a crafted conditional chaining expression via the Content Designer interface, which bypasses the expression sandbox by manipulating JavaScript prototypes. This enables arbitrary code execution within the Lambda fulfillment environment, granting access to sensitive backend resources like Lambda environment variables, OpenSearch indices, S3 objects, and DynamoDB tables that are normally inaccessible through standard administrative interfaces. AWS has released version 7.3.0 and above to fix this issue. The vulnerability scores 7.2 on the CVSS v3.1 scale, indicating high severity. AWS manages this as a cloud service and provides a security bulletin for further details.

Successful exploitation allows an authenticated administrator to execute arbitrary code within the Lambda fulfillment environment, potentially leading to unauthorized access to sensitive backend resources including environment variables, OpenSearch indices, S3 buckets, and DynamoDB tables. This can compromise confidentiality, integrity, and availability of these resources. The vulnerability is high severity with a CVSS score of 7.2. No known exploits in the wild have been reported.

AWS manages remediation for this cloud-hosted service. Users should upgrade QnABot on AWS to version 7.3.0 or later as recommended by AWS in their security advisory (https://aws.amazon.com/security/security-bulletins/2026-020-aws/). This upgrade addresses the improper use of the static-eval package and mitigates the code injection vulnerability. Check the vendor advisory for the latest remediation guidance.