CVE-2026-55240

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55240
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55240.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55240
Aliases
  • GHSA-5grg-j3cr-3hpm
Published
2026-10-15T18:15:12Z
Modified
2026-10-30T02:30:24Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates
Details

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1336"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55240.json"
}
References

Affected packages

Git / github.com/msgbyte/tianji

Affected ranges

Type
GIT
Repo
https://github.com/msgbyte/tianji
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b22f41c6896e2845a467c088d414dfcd277951d4
Fixed
132ff67907df897d222829ea8ad1a018ff74df48
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.31.29"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "132ff67907df897d222829ea8ad1a018ff74df48"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.31.29",
            "range": [
                {
                    "fixed": "b22f41c6896e2845a467c088d414dfcd277951d4"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.11.3
tianji-0.*
tianji-0.1.17
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.2.0
v0.3.0
v0.3.1
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.12.0
v1.12.1
v1.13.0
v1.13.1
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.14.4
v1.14.5
v1.14.6
v1.14.7
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.15.6
v1.15.7
v1.15.8
v1.16.0
v1.16.1
v1.16.2
v1.16.3
v1.16.4
v1.16.5
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.18.0
v1.18.1
v1.18.10
v1.18.11
v1.18.12
v1.18.13
v1.18.14
v1.18.15
v1.18.16
v1.18.17
v1.18.18
v1.18.19
v1.18.2
v1.18.20
v1.18.21
v1.18.22
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.18.7
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.19.5
v1.19.6
v1.19.7
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.20.0
v1.20.1
v1.20.10
v1.20.2
v1.20.3
v1.20.4
v1.20.5
v1.20.6
v1.20.7
v1.20.8
v1.20.9
v1.21.0
v1.21.1
v1.21.10
v1.21.11
v1.21.12
v1.21.13
v1.21.14
v1.21.15
v1.21.16
v1.21.17
v1.21.2
v1.21.3
v1.21.4
v1.21.5
v1.21.6
v1.21.7
v1.21.8
v1.21.9
v1.22.0
v1.22.1
v1.22.2
v1.22.3
v1.22.4
v1.22.5
v1.22.6
v1.23.0
v1.23.1
v1.23.2
v1.23.3
v1.23.4
v1.23.5
v1.24.0
v1.24.1
v1.24.10
v1.24.11
v1.24.12
v1.24.13
v1.24.14
v1.24.15
v1.24.16
v1.24.17
v1.24.18
v1.24.19
v1.24.2
v1.24.20
v1.24.21
v1.24.22
v1.24.23
v1.24.24
v1.24.25
v1.24.26
v1.24.27
v1.24.28
v1.24.29
v1.24.3
v1.24.4
v1.24.5
v1.24.6
v1.24.7
v1.24.8
v1.24.9
v1.25.0
v1.25.1
v1.25.10
v1.25.11
v1.25.12
v1.25.13
v1.25.14
v1.25.2
v1.25.3
v1.25.4
v1.25.5
v1.25.6
v1.25.7
v1.25.8
v1.25.9
v1.26.0
v1.26.1
v1.26.2
v1.26.3
v1.26.4
v1.27.0
v1.27.1
v1.27.10
v1.27.11
v1.27.12
v1.27.2
v1.27.3
v1.27.4
v1.27.5
v1.27.6
v1.27.7
v1.27.8
v1.27.9
v1.28.0
v1.29.0
v1.29.1
v1.29.2
v1.3.0
v1.3.1
v1.30.0
v1.30.1
v1.30.10
v1.30.11
v1.30.12
v1.30.13
v1.30.14
v1.30.15
v1.30.16
v1.30.17
v1.30.18
v1.30.19
v1.30.2
v1.30.20
v1.30.21
v1.30.22
v1.30.23
v1.30.24
v1.30.25
v1.30.3
v1.30.4
v1.30.5
v1.30.6
v1.30.7
v1.30.8
v1.30.9
v1.31.0
v1.31.1
v1.31.10
v1.31.11
v1.31.12
v1.31.13
v1.31.14
v1.31.15
v1.31.16
v1.31.17
v1.31.18
v1.31.19
v1.31.2
v1.31.20
v1.31.21
v1.31.22
v1.31.23
v1.31.24
v1.31.25
v1.31.26
v1.31.27
v1.31.28
v1.31.3
v1.31.4
v1.31.5
v1.31.6
v1.31.7
v1.31.8
v1.31.9
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55240.json"