CVE-2026-55239
8.8HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Authenticated workspace members, including read-only viewers, can run arbitrary SQL queries against the underlying PostgreSQL database. This allows attackers to view or alter credentials, API keys, and multi-tenant data, or cause a denial of service.
Root cause
The getDateQuery() function directly interpolates the user-supplied timezone request value into raw Prisma SQL queries without parameter binding.
Affected systems
Tianji prior to 1.31.29
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Tianji to version 1.31.29 or later. If patching immediately is not possible, block or sanitize the timezone HTTP header and payload fields at your reverse proxy or WAF.
$ docker pull foxiswho/tianji:v1.31.29AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.