CVE-2026-55239
Deferred Deferred - Pending Action

SQL Injection in Tianji Analytics Platform

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-55239
EUVD
EUVD-2026-102244

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
msgbyte tianji < 1.31.29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the Tianji analytics platform. The getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL by interpolating the timezone request value without parameter binding. An attacker can inject malicious SQL code through the timezone parameter or HTTP header, allowing execution of arbitrary SQL against the PostgreSQL database.

Detection Guidance

Check if your Tianji instance is running a version prior to 1.31.29. Inspect logs for unusual SQL queries or errors in analytics endpoints. Look for requests with timezone headers or parameters containing SQL-like syntax such as quotes, semicolons, or keywords like UNION, SELECT, or DROP.

Impact Analysis

An attacker can disclose or modify credentials, API keys, and tenant data. They can also make the service unavailable through denial-of-service. The impact includes full database access, potential operating system access depending on PostgreSQL configuration, and data exfiltration or corruption.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security such as GDPR and HIPAA due to unauthorized data access, potential data breaches, and insufficient security controls for protecting sensitive information.

Mitigation Strategies

Upgrade Tianji to version 1.31.29 or later immediately. Review and restrict access to analytics endpoints. Monitor database logs for suspicious queries. Consider revoking exposed credentials and API keys if potential compromise is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart