CVE-2026-55239 in Tianji
Summary
by MITRE • 10/15/2026
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
Tianji serves as an open-source platform designed for analytics, uptime monitoring, and server status tracking, relying heavily on database interactions to aggregate and present operational metrics. A critical security flaw was identified within the application's data handling logic prior to version 1.31.29, specifically residing in the getDateQuery function located in the src/server/utils/prisma.ts module. This vulnerability stems from improper neutralization of special elements used in an SQL command, commonly categorized under CWE-89 as Improper Neutralization of Special Elements used in an SQL Command. The core technical failure involves the construction of raw SQL queries using Prisma.sql() by directly interpolating user-supplied input without employing parameter binding or prepared statements. Specifically, the timezone value extracted from either HTTP request data or the timezone HTTP header is inserted directly into the query string, allowing for the injection of malicious SQL syntax that alters the intended logic of the database operation.
The operational impact of this vulnerability is severe due to the broad access permissions associated with the affected code path. The workspaceProcedure middleware permits any authenticated user within a workspace to trigger these analytics queries, including individuals assigned read-only viewer roles who typically lack administrative privileges or direct data modification rights. This discrepancy between intended permission levels and actual execution capabilities allows an attacker with minimal credentials to exploit the flaw against the shared PostgreSQL database backend. By crafting specific timezone inputs containing SQL injection payloads, an unauthorized user can execute arbitrary commands on the underlying database engine.
The consequences of successful exploitation are multifaceted and potentially devastating for organizations relying on Tianji for critical infrastructure monitoring. An attacker could exfiltrate sensitive information such as stored credentials, API keys, and proprietary tenant data by leveraging standard SQL techniques like UNION-based or error-based injection to retrieve additional table contents. Furthermore, the vulnerability allows for unauthorized modification of database records, which could lead to data integrity loss or the manipulation of analytics results to hide malicious activities. In more severe scenarios, an attacker might execute commands that disrupt service availability, effectively causing a denial-of-service condition by corrupting critical tables or exhausting database resources through complex injected queries.
To mitigate this vulnerability and prevent future occurrences, it is imperative for organizations running Tianji versions prior to 1.31.29 to upgrade immediately to version 1.31.29 where the issue has been resolved. The fix involves refactoring the getDateQuery function to utilize parameterized queries or prepared statements provided by the Prisma ORM layer, ensuring that user-supplied timezone values are treated strictly as data rather than executable code. For environments unable to upgrade immediately due to operational constraints, implementing a Web Application Firewall with rules capable of detecting and blocking SQL injection patterns in HTTP headers and request parameters can provide a temporary defensive layer. Additionally, enforcing strict input validation on the timezone parameter to accept only expected alphanumeric or standard time zone identifier formats can reduce the attack surface until the software update is applied.