Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55240— Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates

Quick assessment

Affected
msgbyte tianji
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tianji 是一款开源的分析、运行状态监控和服务器状态平台。在版本 1.31.29 之前， 中的 函数会将调查反馈模板和监控通知模板传入 lodash 的 方法，同时默认的“evaluate”模式仍处于启用状态。攻击者若为工作区管理员，可以通过 格式存储 evaluate 代码块；而公开的 接口会在未认证用户提交调查响应时渲染该调查模板。编译后的模板会在 Tianji 的 Node.js 进程中执行服务端 JavaScript，从而导致任意命令执行、密钥泄露、数据篡改或服务中断。该问题已在版本 1.31.29 中

CVSS 9.1 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
msgbyte tianji < 1.31.29 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55240

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates
Source: CVE Program / CVE List V5
Vulnerability Description
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
msgbyte tianji < 1.31.29 -

II. Public POCs for CVE-2026-55240

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55240

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55240 (1)

Other References for CVE-2026-55240 (1)

IV. Related Vulnerabilities

Same product: tianji
Same vendor: msgbyte
Same weakness: CWE-1336

V. Comments for CVE-2026-55240

No comments yet

Leave a comment