CVE-2026-7191: qnabot-on-aws RCE Vulnerability

CVE-2026-7191 Overview

CVE-2026-7191 is a Code Injection vulnerability affecting the open source qnabot-on-aws solution. The vulnerability stems from improper use of the static-eval npm package in qnabot-on-aws versions 7.2.4 and earlier. An authenticated administrator can execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Content Designer interface. The attack bypasses the intended expression sandbox through JavaScript prototype manipulation.

Critical Impact
Successful exploitation grants direct access to backend resources including Lambda environment variables, OpenSearch indices, S3 objects, and DynamoDB tables that are not exposed through normal administrative interfaces.

Affected Products

qnabot-on-aws versions 7.2.4 and earlier
AWS Lambda fulfillment functions using vulnerable qnabot-on-aws deployments
Backend resources accessible via compromised Lambda execution context (OpenSearch, S3, DynamoDB)

Discovery Timeline

April 27, 2026 - CVE-2026-7191 published to NVD
April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-7191

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in how qnabot-on-aws implements expression evaluation through the static-eval npm package. The intended design uses static-eval to safely evaluate JavaScript expressions within a sandbox, preventing arbitrary code execution. However, the implementation fails to account for JavaScript prototype manipulation techniques that can escape the sandbox environment.

When an authenticated administrator uses the Content Designer interface to create or modify Q&A content, they can inject specially crafted conditional chaining expressions. These expressions leverage JavaScript's prototype chain to access objects and functions outside the intended evaluation scope. Once the sandbox is bypassed, the attacker gains code execution within the AWS Lambda fulfillment context.

The elevated execution context is particularly dangerous because Lambda functions in qnabot-on-aws are typically granted broad IAM permissions to interact with multiple AWS services including OpenSearch for search indexing, S3 for content storage, and DynamoDB for session and configuration data.

Root Cause

The root cause is the improper integration of the static-eval npm package without adequate safeguards against prototype pollution and prototype chain traversal attacks. The static-eval package is designed to evaluate static JavaScript expressions safely, but it requires careful configuration to prevent escape scenarios. The qnabot-on-aws implementation did not sufficiently restrict access to JavaScript built-in objects and their prototypes, allowing attackers to construct expressions that break out of the evaluation sandbox.

Attack Vector

The attack requires network access and high-privilege authentication (administrator role). The attacker must:

Authenticate to the qnabot-on-aws Content Designer interface with administrative credentials
Navigate to content creation or editing functionality
Inject a malicious conditional chaining expression that exploits JavaScript prototype manipulation
Trigger evaluation of the expression through normal Q&A bot functionality
The injected code executes within the Lambda context, providing access to environment variables, AWS SDK credentials, and backend resources

The attack does not require user interaction beyond the attacker's own actions and can be performed remotely over the network. While administrative privileges are required, the vulnerability allows the administrator to exceed their intended access boundaries by reaching backend resources not exposed through administrative interfaces.

Detection Methods for CVE-2026-7191

Indicators of Compromise

Unusual Lambda function invocations with unexpected execution patterns or extended duration
CloudWatch logs showing atypical JavaScript expression evaluation errors or prototype-related warnings
Unauthorized access patterns to OpenSearch indices, S3 buckets, or DynamoDB tables from Lambda execution roles
Content Designer audit logs revealing suspicious expression patterns containing prototype chain references

Detection Strategies

Monitor AWS CloudTrail for Lambda invocations with anomalous API call patterns to backend services
Implement log analysis rules to detect prototype manipulation keywords in Content Designer submissions (e.g., __proto__, constructor, prototype)
Configure AWS CloudWatch alarms for unusual data access patterns from qnabot fulfillment Lambda functions
Review Content Designer changes for expressions containing conditional chaining with nested object references

Monitoring Recommendations

Enable detailed CloudWatch logging for all qnabot-on-aws Lambda functions
Configure AWS Security Hub to monitor for anomalous IAM permission usage from Lambda execution roles
Implement real-time alerting on S3, DynamoDB, and OpenSearch access patterns from qnabot infrastructure
Establish baseline metrics for Lambda execution duration and memory usage to detect code injection activity

How to Mitigate CVE-2026-7191

Immediate Actions Required

Upgrade qnabot-on-aws to version 7.3.0 or above immediately
Audit Content Designer logs for any suspicious expression patterns that may indicate exploitation attempts
Review IAM permissions granted to qnabot Lambda execution roles and apply least-privilege principles
Rotate any credentials or secrets stored in Lambda environment variables as a precaution

Patch Information

AWS has released version 7.3.0 of qnabot-on-aws which addresses this vulnerability. The patch improves the integration with the static-eval package by implementing additional safeguards against prototype manipulation attacks. Organizations should upgrade to this version as soon as possible. For additional details, refer to the AWS Security Bulletin 2026-020 and the GitHub Release v7.3.0 for Qnabot.

Workarounds

Restrict Content Designer access to only essential personnel until the patch is applied
Implement additional input validation at the application layer to filter expressions containing prototype-related keywords
Deploy AWS WAF rules to detect and block suspicious payloads targeting the Content Designer interface
Monitor and limit the IAM permissions available to qnabot Lambda functions to reduce the impact of potential exploitation

bash

# Example: Update qnabot-on-aws using CloudFormation
aws cloudformation update-stack \
  --stack-name qnabot-main \
  --template-url https://solutions-reference.s3.amazonaws.com/qnabot-on-aws/v7.3.0/qnabot-on-aws.template \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND