External risk intelligence

Tianji Template Injection Leads to Server-Side Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-55240

Tianji is a server-side monitoring and analytics platform designed to be web-accessible. The vulnerability is triggered via the public survey.submit endpoint, which is explicitly designed to receive inputs from unauthenticated users over the internet in normal operation.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Tianji, an open-source analytics and monitoring platform, allows for potential command execution, secret disclosure, data modification, or service disruption. This issue arises from how certain templates are processed, enabling an administrator to inject malicious code that can be executed on the server when an unauthenticated user submits a survey response.

Code execution via survey templates.
Affects server analytics and monitoring.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by crafting a malicious survey or notification template that includes executable JavaScript code. This template could be stored and later rendered when an unauthenticated user submits a survey response. The server then processes this template, leading to the execution of the attacker's code within the Tianji Node.js process, potentially allowing for command execution and other severe impacts.

Requires administrator to store malicious template.
Public survey endpoint triggers template rendering.
Allows command execution and secret disclosure.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated user submitting a survey response could trigger server-side JavaScript execution in the Tianji Node.js process, potentially leading to command execution, disclosure of secrets, modification of data, or disruption of the service.

Server-side JavaScript execution.
Triggered via public survey submission.
Could lead to data loss or disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Tianji platform's command execution vulnerability requires a workspace administrator to have previously configured specific template settings. This means platform or infrastructure teams managing Tianji instances should first confirm if the affected configurations are present and if the `survey.submit` endpoint is exposed externally. Once identified, the accountable owner must be determined to plan remediation, prioritizing critical and reachable instances.

Platform owners should manage this issue.
Verify `survey.submit` endpoint exposure.
Plan remediation for exposed instances.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tianji platform used for?

Tianji is an open-source software suite designed for website analytics, uptime monitoring, and tracking server health. It typically runs as a Node.js process on a server, providing dashboards and notification systems for administrators to monitor their infrastructure performance.

What does CWE-1336 mean for CVE-2026-55240?

CWE-1336 refers to Improper Neutralization of Special Elements Used in a Template Engine. In this case, the software fails to safely process template strings, allowing untrusted input to be interpreted as executable instructions. This weakness enables an attacker to perform server-side JavaScript injection, giving them the power to execute commands, modify data, or access sensitive files on the underlying server.

How is the vulnerability triggered in Tianji?

The flaw is triggered when the system renders a survey template containing malicious code. Crucially, simply submitting a survey does not trigger the bug if the template has not been specifically prepared; a workspace administrator must first store an evaluate block, such as <% code %>, within a template. Once that malicious template is stored, the public survey submission endpoint executes the hidden code.

Is my Tianji instance at risk?

According to Halo Surface Signal, this instance is at high risk because Tianji is intended to be a web-accessible monitoring platform. Because the trigger relies on the public survey.submit endpoint—which is explicitly designed to accept input from unauthenticated users over the internet—any instance of Tianji exposed to the public is potentially reachable for this attack.

How do I secure my Tianji installation?

The primary response is to update your software to version 1.31.29 or later, which resolves the template processing issue. Before updating, you should verify which of your instances are running older versions and confirm if they have publicly accessible survey endpoints, as these are the most immediate priorities for applying the fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.