https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 16:42:47 +0000 https://db.gcve.eu/vuln/cve-2026-55240 <p><strong>Affected:</strong> msgbyte tianji</p> <p>Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the &lt;% code %&gt; form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.</p> <p><strong>Affected:</strong> msgbyte tianji</p> <p>Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the &lt;% code %&gt; form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.</p> https://db.gcve.eu/vuln/cve-2026-55240