CVE-2026-55239: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in msgbyte tianji

Tianji versions before 1.31.29 contain a SQL Injection vulnerability (CWE-89) in the getDateQuery() function located in src/server/utils/prisma.ts. The function constructs raw SQL queries using Prisma.sql() by directly interpolating the timezone value from request data or the timezone HTTP header without using parameter binding. Since any authenticated workspace member, including those with read-only access, can trigger these queries via workspaceProcedure, an attacker can execute arbitrary SQL commands against the shared PostgreSQL database. This can result in unauthorized disclosure or modification of credentials, API keys, tenant data, or denial of service. The vulnerability is resolved in version 1.31.29.

An attacker with authenticated access to a workspace, even with read-only permissions, can exploit this vulnerability to execute arbitrary SQL commands on the shared PostgreSQL database. This can lead to high impact outcomes including disclosure and modification of sensitive data such as credentials and API keys, as well as potential service unavailability. The CVSS v3.1 score is 8.8, indicating a high severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

Upgrade Tianji to version 1.31.29 or later, where this SQL Injection vulnerability has been fixed by properly handling the timezone value with parameter binding. No other mitigation is required as the fix addresses the root cause.