{"schema":"threatline.record/2","record":{"id":"CVE-2026-55240","aliases":["GHSA-5grg-j3cr-3hpm"],"summary":"Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates","details":"Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.","categories":["Unclassified"],"product":"tianji","vendor":"msgbyte","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55240","source_modified_at":"2026-10-15T18:15:12.957Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"tianji","vendor":"msgbyte","versions":[{"status":"affected","version":"< 1.31.29"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm","source_modified_at":"2026-06-18T02:57:57Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"tianji"},"range":"<= 1.31.28"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm","source_modified_at":"2026-06-18T02:57:57Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"tianji"},"version":"1.31.29"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00576,"percentile":0.46813,"score_date":"2026-10-23"},"published_at":"2026-10-15T18:15:12.957Z","modified_at":"2026-10-15T18:15:12.957Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-55240","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T18:15:12.957Z"},{"source":"GitHub Advisory Database","url":"https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm","fetched_at":"2026-10-23T18:58:35.272684Z","source_modified_at":"2026-06-18T02:57:57Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55240","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/msgbyte/tianji/releases/tag/v1.31.29","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T18:15:12.957Z","content_hash":"f8a151af270e5f6db4fbfc0f94a7f9dc427f41f726ffb94343b0d6455669a0fc"}}