Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for tianji by msgbyte

    CVE-2026-55240 (GCVE-0-2026-55240)

    Vulnerability from nvd – Published: 2026-10-15 18:15 – Updated: 2026-10-15 18:15
    VLAI
    Title
    Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates
    Summary
    Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    CWE
    • CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7720 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    msgbyte tianji Affected: < 1.31.29
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "tianji",
          "vendor": "msgbyte",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.31.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the \u003c% code %\u003e form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:15:12.957Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm"
        },
        {
          "name": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48"
        },
        {
          "name": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29"
        }
      ],
      "source": {
        "advisory": "GHSA-5grg-j3cr-3hpm",
        "discovery": "UNKNOWN"
      },
      "title": "Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55240",
    "datePublished": "2026-10-15T18:15:12.957Z",
    "dateReserved": "2026-06-16T16:44:00.624Z",
    "dateUpdated": "2026-10-15T18:15:12.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-55239 (GCVE-0-2026-55239)

    Vulnerability from nvd – Published: 2026-10-15 18:14 – Updated: 2026-10-15 18:14
    VLAI
    Title
    Tianji: SQL Injection via unsanitized timezone parameter in analytics queries
    Summary
    Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7720 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    msgbyte tianji Affected: < 1.31.29
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "tianji",
          "vendor": "msgbyte",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.31.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:14:21.918Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4"
        },
        {
          "name": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48"
        },
        {
          "name": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29"
        }
      ],
      "source": {
        "advisory": "GHSA-v9jm-vvrj-53c4",
        "discovery": "UNKNOWN"
      },
      "title": "Tianji: SQL Injection via unsanitized timezone parameter in analytics queries"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55239",
    "datePublished": "2026-10-15T18:14:21.918Z",
    "dateReserved": "2026-06-16T16:44:00.624Z",
    "dateUpdated": "2026-10-15T18:14:21.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-55240 (GCVE-0-2026-55240)

    Vulnerability from cvelistv5 – Published: 2026-10-15 18:15 – Updated: 2026-10-15 18:15
    VLAI
    Title
    Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates
    Summary
    Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    CWE
    • CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7720 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    msgbyte tianji Affected: < 1.31.29
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "tianji",
          "vendor": "msgbyte",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.31.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the \u003c% code %\u003e form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:15:12.957Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm"
        },
        {
          "name": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48"
        },
        {
          "name": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29"
        }
      ],
      "source": {
        "advisory": "GHSA-5grg-j3cr-3hpm",
        "discovery": "UNKNOWN"
      },
      "title": "Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55240",
    "datePublished": "2026-10-15T18:15:12.957Z",
    "dateReserved": "2026-06-16T16:44:00.624Z",
    "dateUpdated": "2026-10-15T18:15:12.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-55239 (GCVE-0-2026-55239)

    Vulnerability from cvelistv5 – Published: 2026-10-15 18:14 – Updated: 2026-10-15 18:14
    VLAI
    Title
    Tianji: SQL Injection via unsanitized timezone parameter in analytics queries
    Summary
    Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7720 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    msgbyte tianji Affected: < 1.31.29
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "tianji",
          "vendor": "msgbyte",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.31.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:14:21.918Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4"
        },
        {
          "name": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48"
        },
        {
          "name": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29"
        }
      ],
      "source": {
        "advisory": "GHSA-v9jm-vvrj-53c4",
        "discovery": "UNKNOWN"
      },
      "title": "Tianji: SQL Injection via unsanitized timezone parameter in analytics queries"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55239",
    "datePublished": "2026-10-15T18:14:21.918Z",
    "dateReserved": "2026-06-16T16:44:00.624Z",
    "dateUpdated": "2026-10-15T18:14:21.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}