Tianji Patch Fixes Critical RCE Flaw in Survey Templates
Tianji 1.31.29 resolves a CVSS 9.1 vulnerability allowing workspace admins to execute arbitrary code via survey templates.
Key points
- CVE-2026-55240 allows server-side JavaScript execution in Tianji versions prior to 1.31.29.
- The flaw stems from an enabled evaluate pattern in lodash template processing.
- Unauthenticated users can trigger the exploit by submitting survey responses.
Tianji version 1.31.29 addresses a critical remote code execution vulnerability that allows attackers to run arbitrary commands on affected servers. The issue, tracked as CVE-2026-55240, carries a CVSS score of 9.1 and impacts the open-source analytics and monitoring platform.
At a glance
- CVE
- CVE-2026-55240
- Product
- msgbyte tianji
- CVSS
- 9.1 Critical
- Weakness
- CWE-1336
- Exploited
- No known exploitation
The vulnerability exists in the formatString function within the template utility module. This function passes survey feed templates and monitor notification templates to the lodash template engine. Crucially, the default evaluate pattern remains enabled in these configurations. This setting permits the execution of server-side JavaScript code within the Node.js process.
Technical Details of the Flaw
According to the National Vulnerability Database record, the flaw is classified under CWE-1336. A workspace administrator can store an evaluate block using the specific <% code %> syntax within a template. When the public survey.submit endpoint renders a survey template, it processes this stored code. An unauthenticated user can trigger this rendering simply by submitting a response to the survey.
The compiled template executes the injected JavaScript in the context of the Tianji server process. This execution model allows for command execution, disclosure of secrets, modification of data, or service disruption. The vendor has released version 1.31.29 to fix this issue.
Affected Versions and Scope
The vulnerability affects all versions of Tianji prior to 1.31.29. The software is developed by msgbyte. As Threat Times reported on 2026-10-15 regarding other critical flaws in infrastructure software, such high-severity issues often require immediate attention due to their potential for total system compromise.
The exploit requires an attacker to interact with a survey endpoint. However, the initial payload must be placed by a workspace administrator. This means the threat model involves a malicious or compromised administrator account. Once the template is stored, any unauthenticated user can trigger the execution.
What should you do?
Administrators should verify their current Tianji version immediately. If running a version lower than 1.31.29, they should apply the update as soon as possible. Users should also audit their survey templates for any suspicious evaluate blocks. Monitoring server logs for unusual JavaScript execution can help detect exploitation attempts.
What to do and how to stay safe: Tianji
- Check your current Tianji version and upgrade to 1.31.29 if you are running an older release.
- Audit existing survey and notification templates for any code blocks using the <% code %> syntax.
- Review server logs for unexpected JavaScript execution or command activity originating from the template engine.
- Restrict workspace administrator privileges to reduce the risk of malicious template injection.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-55240?
The vulnerability has a CVSS score of 9.1, which is rated as critical.
How can an attacker trigger the code execution?
An unauthenticated user can trigger the execution by submitting a response to a survey that contains a malicious template.
Which versions of Tianji are vulnerable?
All versions of Tianji prior to 1.31.29 are affected by this vulnerability.
