Threats affecting pkg:npm/static-eval

CVE-2026-7191 is a high-severity vulnerability in AWS QnABot on AWS versions up to 7.2.4. It involves improper control of code generation due to unsafe use of the static-eval npm package. An authenticated administrator can inject crafted expressions via the Content Designer interface to execute arbitrary code in the Lambda fulfillment environment, potentially accessing backend resources like environment variables, OpenSearch indices, S3 objects, and DynamoDB tables. AWS recommends upgrading to version 7.3.0 or later to remediate this issue.