CVE-2026-55240

CRITICAL 9.1

Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.

CWE	CWE-1336
Vendor	msgbyte
Product	tianji
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for msgbyte tianji

Be the first to know when new critical vulnerabilities affecting msgbyte tianji are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

msgbyte / tianji

< 1.31.29

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm github.com: https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48 github.com: https://github.com/msgbyte/tianji/releases/tag/v1.31.29