Key points
- CVE-2026-55240 affects Tianji versions prior to 1.31.29.
- The flaw allows server-side JavaScript execution via survey submissions.
- A patch is available in version 1.31.29.
Tianji has released version 1.31.29 to address a critical security vulnerability in its open-source monitoring platform. The update resolves an issue that permitted unauthenticated users to execute arbitrary code on the server through survey submissions.
What happened
The vulnerability, identified as CVE-2026-55240, is rated critical with a CVSS score of 9.1 by the National Vulnerability Database. It stems from improper handling of template strings in the `src/server/utils/template.ts` file of Tianji installations running versions earlier than 1.31.29. The `formatString()` function passes survey feed templates and monitor notification templates to the lodash `template()` method while leaving the default evaluate pattern enabled. This configuration allows workspace administrators to store evaluation blocks using the `<% code %>` syntax within templates.
When an unauthenticated user submits a response via the public `survey.submit` endpoint, the application renders the stored survey template. This process executes the embedded server-side JavaScript within the Tianji Node.js process. Consequently, attackers can perform command execution, disclose secrets, modify data, or disrupt services without needing valid credentials. This flaw aligns with CWE-1336, which relates to improper neutralisation of special elements used in a command.
Why it matters
Organisations using Tianji for uptime monitoring and server status tracking face immediate risk if they have public-facing surveys enabled. The ability for unauthenticated users to trigger code execution bypasses standard authentication controls. This exposes the underlying infrastructure to full compromise, including data theft and service interruption. The critical severity rating underscores the potential for rapid exploitation by automated scanning tools or targeted adversaries.
What happens next
- Update Tianji installations to version 1.31.29 immediately.
- Audit existing survey templates for any stored evaluation blocks.
- Review access logs for suspicious activity on the survey submit endpoint.
- Verify that no sensitive data was exfiltrated during the window of exposure.
Patch priority
Teams should prioritise updating systems with public-facing survey capabilities first, as these present the highest exposure to unauthenticated attackers. Before applying the patch, ensure a current backup of the Tianji instance and its configuration files is available. Test the update in a staging environment to verify that monitoring functions and notification templates operate correctly after the upgrade. If immediate patching is not feasible, restrict access to the survey submission endpoint using network-level controls to reduce the attack surface while a fix is prepared.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: Tianji
- Identify all instances of Tianji running versions prior to 1.31.29 within your environment.
- Apply the vendor-provided update to version 1.31.29 to mitigate the vulnerability.
- Monitor server logs for signs of unauthorised code execution or unusual survey submissions.
- Review template configurations to ensure no malicious evaluation blocks remain in use.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Tianji are affected by CVE-2026-55240?
All versions of Tianji prior to 1.31.29 are vulnerable to this critical remote code execution flaw.
Is authentication required to exploit this vulnerability?
No, the flaw allows unauthenticated users to execute code by submitting responses via the public survey endpoint.
What is the severity rating of CVE-2026-55240?
The National Vulnerability Database rates CVE-2026-55240 as critical with a CVSS score of 9.1.
