Tianji: SQL injection via timezone parameter in analytics queries
Summary
Tianji is an open-source analytics, uptime monitoring and server status platform. The getDateQuery() function inserts the timezone value from request data or the timezone HTTP header into raw SQL without parameter binding, allowing SQL injection. Any authenticated workspace member, including a read-only viewer, can reach the affected queries, and an attacker can read or modify data in the shared PostgreSQL database, including credentials, API keys and tenant data, or disrupt the service.
Affected
- Tianji versions before 1.31.29
- VulDB lists the range as up to 1.31.28
- Vendor advisory states the range is below 1.31.29; verify against the primary advisory
Fixed in
- Version 1.31.29 (released 10 Jun 2026)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found
- CISA SSVC: exploitation none, automatable no
- Not listed in KEV
- No public proof of concept found
Our recommendation
- Identify all Tianji instances and their versions
- Upgrade to 1.31.29 or later; the same release also fixes CVE-2026-55240 (critical template issue), so prioritise it
- Audit workspace memberships and remove unneeded accounts
- Restrict network access to the Tianji web interface (VPN or internal-only)
- Limit the database account's privileges to what the application needs
- Review database and logs for unusual queries
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-55239 Fix commit github.com
- Tianji release v1.31.29 github.com
- GitHub Security Advisory GHSA-v9jm-vvrj-53c4 github.com
- VulDB entry 420765 vuldb.com
- OpenCVE CVE-2026-55239 app.opencve.io
- Tianji project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:32.
Original description (NVD)
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.