CVE-2026-55240: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine in msgbyte tianji

Tianji versions before 1.31.29 use lodash's template() function with the default evaluate pattern enabled in formatString() within src/server/utils/template.ts. This allows a workspace administrator to embed <% code %> evaluate blocks in survey feedTemplate and monitor notification templates. When an unauthenticated user submits a survey response via the public survey.submit endpoint, the server compiles and executes these templates, resulting in server-side JavaScript execution within the Node.js process. This vulnerability enables attackers to execute arbitrary commands, disclose secrets, modify data, or disrupt service. The vulnerability is addressed by updating to Tianji version 1.31.29.

Exploitation of this vulnerability allows an attacker to execute arbitrary server-side JavaScript code in the Tianji Node.js process. This can lead to full system compromise including command execution, disclosure of sensitive information, unauthorized data modification, and denial of service. The vulnerability affects the integrity, confidentiality, and availability of the affected system.

Upgrade Tianji to version 1.31.29 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 1.31.29.