CVE-2026-55240

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.

• CWE-1336

• https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48
• https://github.com/msgbyte/tianji/releases/tag/v1.31.29
• https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm
• https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm

Published

Oct 15, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55235langgraph-api implements the LangGraph API for rapid develop…5.9
• CVE-2026-55236langgraph-api implements the LangGraph API for rapid develop…5.9
• CVE-2026-55237AutoGPT is a workflow automation platform for creating, depl…8.8
• CVE-2026-55238xrdp is an open source RDP server. Versions 0.10.6 and prior…5.3
• CVE-2026-55239Tianji is an open source analytics, uptime monitoring, and s…8.8
• CVE-2026-5524The Divi Form Builder plugin for WordPress is vulnerable to …9.8
• CVE-2026-55241Checkmate is an open-source, self-hosted tool designed to tr…7.5
• CVE-2026-55242ERPNext is a free and open source Enterprise Resource Planni…8.8
• CVE-2026-55244ASTEVAL is an evaluator of Python expressions and statements…5
• CVE-2026-55245Bifrost is an enterprise AI gateway for routing requests to …8.7
• CVE-2026-55246bincookie is a header-only binarycookies parser. Prior to 0.…7.8
• CVE-2026-55247plone.app.event provides the event content type for Plone. P…9.1