Read the docs
TI-2026-74983 Aliases CVE-2026-55239

SQL injection in Tianji analytics queries via timezone parameter

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Tianji versions before 1.31.29 are affected. The getDateQuery() function builds raw SQL by inserting the timezone value without parameter binding, which is SQL injection (CWE-89). Any authenticated workspace member, including a read-only viewer, can reach the affected analytics queries and run arbitrary SQL against the shared PostgreSQL database. This can disclose or modify credentials, API keys and tenant data, or make the service unavailable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed tianji (msgbyte): 1.31.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
msgbytetianjibefore 1.31.291.31.29Patch availableCNA
  • tianji Vendormsgbyte Affected before 1.31.29 Fixed in 1.31.29 Patch available CNA

Remediation

Upgrade Tianji to version 1.31.29, which the source description states fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA tianji (msgbyte) Fixed in 1.31.29

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-55239
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-21 CISA SSVC decision points changed
  4. 2026-10-21 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-74984 Remote code execution in Tianji through survey template rendering CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences