Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55239— Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

Quick assessment

Affected
msgbyte tianji
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tianji 是一个开源的分析、运行时间监控和服务器状态平台。在版本 1.31.29 之前，位于 中的 函数通过 Prisma.sql() 拼接原始 SQL 查询语句时，直接将时区请求值插入其中，而未使用参数绑定机制。该时区值可通过请求数据或 Timezone HTTP 请求头传入，并影响相关的分析查询。此外，workspaceProcedure 允许任何经过身份验证的工作区成员（包括只读查看者）执行这些查询。 攻击者可利用此漏洞对共享的 PostgreSQL 数据库执行任意 SQL 语句，从而导致凭据、API 密

CVSS 8.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
msgbyte tianji < 1.31.29 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55239

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tianji: SQL Injection via unsanitized timezone parameter in analytics queries
Source: CVE Program / CVE List V5
Vulnerability Description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
msgbyte tianji < 1.31.29 -

II. Public POCs for CVE-2026-55239

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55239

请登录查看更多情报信息。

Other References for CVE-2026-55239 (3)

IV. Related Vulnerabilities

Same product: tianji
Same vendor: msgbyte
Same weakness: CWE-89

V. Comments for CVE-2026-55239

No comments yet

Leave a comment