Refine your search

2 vulnerabilities found for by msgbyte

CVE-2026-55240 (GCVE-0-2026-55240)
Vulnerability from cvelistv5
Published
2026-10-15 18:15
Modified
2026-10-28 20:04
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Summary
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.
References
Impacted products
Vendor Product Version
msgbyte tianji Version: < 1.31.29
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55240",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T20:04:51.050574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T20:04:59.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tianji",
          "vendor": "msgbyte",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.31.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the \u003c% code %\u003e form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:15:12.957Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm"
        },
        {
          "name": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48"
        },
        {
          "name": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29"
        }
      ],
      "source": {
        "advisory": "GHSA-5grg-j3cr-3hpm",
        "discovery": "UNKNOWN"
      },
      "title": "Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55240",
    "datePublished": "2026-10-15T18:15:12.957Z",
    "dateReserved": "2026-06-16T16:44:00.624Z",
    "dateUpdated": "2026-10-28T20:04:59.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55239 (GCVE-0-2026-55239)
Vulnerability from cvelistv5
Published
2026-10-15 18:14
Modified
2026-10-21 01:02
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.
References
Impacted products
Vendor Product Version
msgbyte tianji Version: < 1.31.29
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55239",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T01:02:18.682889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T01:02:29.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tianji",
          "vendor": "msgbyte",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.31.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:14:21.918Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4"
        },
        {
          "name": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48"
        },
        {
          "name": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29"
        }
      ],
      "source": {
        "advisory": "GHSA-v9jm-vvrj-53c4",
        "discovery": "UNKNOWN"
      },
      "title": "Tianji: SQL Injection via unsanitized timezone parameter in analytics queries"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55239",
    "datePublished": "2026-10-15T18:14:21.918Z",
    "dateReserved": "2026-06-16T16:44:00.624Z",
    "dateUpdated": "2026-10-21T01:02:29.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}