CVE-2026-55240 Details
Description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
A critical remote code execution vulnerability has been identified in Tianji, an open-source analytics and server monitoring platform, in versions prior to 1.31.29. The issue arises because the application uses lodash's template function to render survey feed templates, but only the interpolation pattern is overridden. This oversight allows workspace administrators to inject executable code into the template, which is then executed server-side when an unauthenticated user submits a survey response. The vulnerability can also be exploited through monitor notification templates, potentially leading to unauthorized command execution, disclosure of sensitive information, modification of data, or disruption of services.
Users are advised to update to Tianji version 1.31.29 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48 | [email protected] | Source CodeVendor |
| https://github.com/msgbyte/tianji/releases/tag/v1.31.29 | [email protected] | Release NotesVendor |
| https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| msgbyte Tianji | <= 1.31.28 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |