PT-2026-35526 · Unknown+1 · Qnabot On Aws+1

Endor Labs · Published 2026-04-27 · Updated 2026-04-30 · CVE-2026-7191

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions qnabot-on-aws versions prior to 7.3.0

Description Improper use of the static-eval npm package allows an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context. This is achieved by injecting a crafted conditional chaining expression via the Content Designer interface, which bypasses the expression sandbox through JavaScript prototype manipulation. Successful exploitation may grant direct access to backend resources, including Lambda environment variables, OpenSearch indices, S3 objects, and DynamoDB tables, which are typically not exposed through administrative interfaces.

Recommendations Upgrade to version 7.3.0 or above.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-7191

Affected Products

Qnabot On Aws

Static-Eval

References · 7

• https://github.com/aws-solutions/qnabot-on-aws/releases/tag/v7.3.0 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-020-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7191 · Security Note
• https://twitter.com/KaitanSecurity/status/2048877352013209630 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048891320240898450 · Twitter Post
• https://t.me/CVEtracker/51984 · Telegram Post
• https://twitter.com/eyalestrin/status/2049818107724914865 · Twitter Post