CVE-2026-55239 Details
Description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
A SQL injection vulnerability has been identified in Tianji, an open-source analytics and server monitoring platform, in versions prior to 1.31.29. The issue arises in the 'getDateQuery()' function, which constructs raw SQL by interpolating the 'timezone' parameter from the request without proper sanitization or parameter binding. This unsanitized input can be exploited by any authenticated workspace member, including read-only viewers, to execute arbitrary SQL commands on the shared PostgreSQL database. The exploitation of this vulnerability could lead to unauthorized access to sensitive data such as credentials, API keys, and tenant information, or cause the service to become unavailable.
Users can update to Tianji version 1.31.29, which addresses the vulnerability by sanitizing the 'timezone' parameter before it is used in SQL queries.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48 | [email protected] | Source CodeVendor |
| https://github.com/msgbyte/tianji/releases/tag/v1.31.29 | [email protected] | Release NotesVendor |
| https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tianji | <= 1.31.28 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |