An improper use of the static-eval npm package in the open source solution QnABot on AWS creates an unchecked code execution pathway within the fulfillment Lambda function. By injecting a crafted conditional chaining expression through the Content Designer interface, an authenticated administrator can bypass the intended sandbox and run arbitrary JavaScript in the Lambda execution context. This flaw corresponds to code injection (CWE‑94) and allows the attacker to read or manipulate backend resources such as Lambda environment variables, OpenSearch indices, S3 objects, and DynamoDB tables that are otherwise protected by the platform’s normal administrative controls.

AWS QnABot on AWS, versions 7.2.4 and earlier. All deployments of these versions are potentially vulnerable until they are updated to 7.3.0 or higher.

The vulnerability has a CVSS score of 8.6, indicating high severity. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the flaw is not listed in the CISA KEV catalog. The attack requires that the attacker has authenticated administrator privileges in the Content Designer interface; once those privileges are available, the exploit is straightforward and can allow full access to sensitive backend resources.