CVE-2026-55240: Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates

Q: Who can exploit this issue, and what access do they need?

An attacker needs workspace administrator privileges to save a malicious evaluate block in a survey feed or monitor notification template. They do not need to authenticate to trigger rendering of a malicious survey template after it has been planted, because the public survey.submit endpoint renders it when a response is submitted.

Q: Are default installations affected?

The vulnerable behavior depends on templates being processed through formatString() with lodash's default evaluate pattern enabled. The data does not establish whether a fresh default deployment contains attacker-controlled survey feed or monitor notification templates, but any affected deployment where a workspace administrator can modify those templates is exposed.

Q: What should be done to remediate the issue?

Upgrade Tianji to version 1.31.29, which fixes the issue. If patching cannot happen immediately, restrict workspace administrator access and review survey feed and monitor notification templates for lodash evaluate blocks using the <% code %> form.

Published Oct 15, 2026

Updated

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.

Affected Software

1 affected component

Tianji Tianji<1.31.29

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tianji to a version that resolves this vulnerability.
Fixed in 1.31.29

Event History

Oct 15, 2026

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and what access do they need?

An attacker needs workspace administrator privileges to save a malicious evaluate block in a survey feed or monitor notification template. They do not need to authenticate to trigger rendering of a malicious survey template after it has been planted, because the public survey.submit endpoint renders it when a response is submitted.

Are default installations affected?

The vulnerable behavior depends on templates being processed through formatString() with lodash's default evaluate pattern enabled. The data does not establish whether a fresh default deployment contains attacker-controlled survey feed or monitor notification templates, but any affected deployment where a workspace administrator can modify those templates is exposed.

What should be done to remediate the issue?

Upgrade Tianji to version 1.31.29, which fixes the issue. If patching cannot happen immediately, restrict workspace administrator access and review survey feed and monitor notification templates for lodash evaluate blocks using the <% code %> form.

How can an organization investigate possible compromise?

Review survey feed and monitor notification templates for unexpected <% ... %> evaluate blocks, especially code that accesses secrets, modifies data, executes commands, or disrupts service. Because the code executes in the Tianji Node.js process when the relevant template is rendered, investigate responses submitted to public surveys and template-rendering activity for suspicious behavior.