CVE-2026-55240
9.1CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-1336
Impact
A workspace administrator can execute arbitrary code inside the Tianji Node.js process by configuring a malicious template that triggers when users submit surveys or when notifications fire. This leads to host command execution, stolen server secrets, and full database compromise.
Root cause
The formatString utility passes user-controlled notification and survey templates to lodash.template without disabling the default evaluate pattern delimiters.
Affected systems
Tianji prior to 1.31.29
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade Tianji to version 1.31.29 or newer. If you cannot upgrade immediately, restrict workspace administrator access and disable public survey endpoints.
$ docker pull msgbyte/tianji:v1.31.29AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.