CVE-2026-55240

The record

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.

Affected packages

Related vulnerabilities

• CVE-2026-107264 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-107259 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-1336
• CVE-2026-119144 Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template… CWE-1336
• CVE-2026-118803 Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection… CWE-1336
• CVE-2026-115223 The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent… CWE-1336
• CVE-2026-115938 Craft CMS allows any authenticated control panel user to submit an element-search… CWE-1336
• CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1336