Threat database

CVE-2026-55240 is a critical vulnerability in the open source Tianji platform prior to version 1.31.29. It involves improper neutralization of special elements in a template engine, allowing server-side JavaScript execution via the lodash template function. An authenticated workspace administrator can inject code blocks that get executed when an unauthenticated user submits a survey response, leading to potential command execution, secret disclosure, data modification, or service disruption. The issue is fixed in version 1.31.29.

Tianji, an open source analytics and monitoring platform, contains an SQL injection vulnerability in the getDateQuery() function prior to version 1.31.29. The vulnerability arises because the timezone value is interpolated directly into raw SQL without parameter binding, allowing authenticated workspace members, including read-only viewers, to execute arbitrary SQL commands. This can lead to unauthorized disclosure or modification of sensitive data such as credentials, API keys, and tenant information, or cause service disruption. The issue is resolved in version 1.31.29.