CVE-2026-55240 in Tianji
Summary
by MITRE • 10/15/2026
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as CVE-2024-XXXXX affects Tianji, an open-source platform designed for analytics, uptime monitoring, and server status tracking. The core of the security flaw resides within the template rendering engine used by the application's backend services. Specifically, the formatString function located in src/server/utils/template.ts is responsible for processing survey feed templates and monitor notification templates. This function utilizes the lodash library to compile user-supplied input into executable JavaScript code via its template() method. The critical technical deficiency lies in the configuration of this compilation process; specifically, the default evaluate pattern remains enabled during execution. In standard secure configurations, such patterns should be disabled or strictly sanitized when processing untrusted data to prevent arbitrary code injection. By leaving these evaluation blocks active, the application inadvertently allows any content enclosed within <% %> delimiters to be interpreted as server-side JavaScript rather than static text.
The operational impact of this vulnerability is severe due to its potential for Remote Code Execution (RCE). An attacker with access to a workspace can exploit this flaw by storing malicious payloads in template fields using the evaluate block syntax, such as <% code %>. Although direct administrative privileges are typically required to modify system templates, the specific attack vector involves the public survey.submit endpoint. This endpoint allows unauthenticated users to submit responses to surveys configured within the Tianji instance. When a victim or an automated script submits data that triggers the rendering of a compromised template, the server-side JavaScript embedded in the template is executed immediately by the Node.js process hosting the application. Because this execution occurs with the privileges of the running service account, it grants the attacker full control over the underlying system environment.
The consequences of successful exploitation are extensive and align closely with high-severity impact categories defined in industry standards. The vulnerability maps to CWE-94 Improper Control of Generation of Code (Code Injection) as well as CWE-502 Deserialization of Untrusted Data, depending on how the template engine processes the input stream. From an offensive security perspective, this behavior is consistent with ATT&CK technique T1059 Command and Scripting Interpreter, specifically allowing for arbitrary command execution within the server environment. Attackers can leverage this access to disclose sensitive secrets stored in memory or configuration files, modify critical application data leading to integrity violations, or disrupt services by consuming excessive resources or terminating processes. This effectively compromises the confidentiality, integrity, and availability of both the Tianji platform and potentially other systems accessible from the compromised host network segment.
Mitigation for this vulnerability requires immediate action by administrators managing instances of Tianji prior to version 1.31.29. The primary remediation step is to upgrade the application to version 1.31.29 or later, where the developers have addressed the unsafe template compilation settings and restricted the execution context of user-supplied data. In environments where upgrading is not immediately feasible, temporary mitigations should include disabling public survey submission endpoints if they are not strictly required for business operations. Additionally, implementing strict input validation on all fields that feed into template rendering engines can help block malicious payloads containing JavaScript evaluation syntax before they reach the lodash compiler. Network-level controls such as Web Application Firewalls may also be configured to detect and block requests containing suspicious template injection patterns, although this is a less reliable defense than patching the underlying software defect.