CVE-2026-55240
Received Received - Intake

Server-Side Template Injection in Tianji Analytics Platform

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-55240
EUVD
EUVD-2026-102246

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
msgbyte tianji < 1.31.29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Tianji, an analytics and monitoring platform, allows a workspace administrator to inject server-side JavaScript code via a template. The flaw exists in the formatString() function which passes survey and monitor templates to lodash's template engine without disabling the default evaluate pattern. An attacker can use the <%%> syntax to execute arbitrary code on the server when a survey is submitted by an unauthenticated user.

Detection Guidance

Check if Tianji is running a version prior to 1.31.29 by running: grep -r "version" /path/to/tianji/package.json or checking the admin dashboard. Inspect server logs for unusual JavaScript execution patterns or unauthorized access attempts.

Impact Analysis

This vulnerability can lead to severe impacts including remote command execution on the server, disclosure of sensitive data, modification or deletion of data, and disruption of services. As a workspace administrator or user, your server could be compromised, leading to potential data breaches or system outages.

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to personal or health data, leading to data breaches. Such breaches may result in legal penalties, loss of trust, and significant financial consequences due to non-compliance with data protection requirements.

Mitigation Strategies

Upgrade Tianji to version 1.31.29 or later immediately. If immediate upgrade is not possible, disable the survey.submit endpoint or restrict access to trusted users only. Review all survey and monitor templates for unauthorized JavaScript blocks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart