Tianji: Remote code execution via template evaluate pattern in survey templates
Summary
Tianji, an open source analytics, uptime monitoring and server status platform, renders survey feed templates and monitor notification templates with lodash template() while the evaluate pattern remains enabled. A workspace administrator can store a template containing server-side JavaScript, which is executed when an unauthenticated user submits a response to a public survey. Successful exploitation allows command execution in the Node.js process, disclosure of secrets such as database credentials and API keys, data modification or service disruption.
Affected
- Tianji versions prior to 1.31.29
Fixed in
- Fixed in version 1.31.29 (commit 132ff67)
Workaround
Unknown. No vendor-documented workaround was found; check GHSA-5grg-j3cr-3hpm.
Exploitation
- Public proof of concept: no evidence found, status unconfirmed.
- Known exploitation in the wild: no evidence found.
- CISA SSVC assessment: exploitation status 'poc', automatable 'no', technical impact 'total'.
- Positive Technologies (PT-2026-115109) describes the issue as unauthenticated remote code execution; the CVSS vector requires high privileges, so this label should be treated with caution.
Our recommendation
- Upgrade Tianji to version 1.31.29 or later and check the releases page for the current version.
- Patch CVE-2026-55239 (SQL injection, fixed in the same release) at the same time.
- Limit workspace administrator accounts to those who need them and enforce MFA on them.
- Restrict network access to the admin interface where possible.
- Review existing survey and monitor notification templates for unexpected template code.
- Review logs for unusual survey submissions.
- Prioritise internet-facing instances.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5grg-j3cr-3hpm github.com
- Fix commit 132ff67 github.com
- Tianji release v1.31.29 github.com
- Tianji releases github.com
- OpenCVE CVE-2026-55240 app.opencve.io
- Positive Technologies PT-2026-115109 vulners.com
- VulDB entry 420767 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:28.
Original description (NVD)
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.