Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M

CVE-2026-55239Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

High 8.8

In plain English

A high-severity SQL injection in tianji from msgbyte. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 72.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.

Affected products (as reported)

Vendor	Product	Versions
msgbyte	tianji	< 1.31.29

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4 x_refsource_CONFIRM
https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48 x_refsource_MISC
https://github.com/msgbyte/tianji/releases/tag/v1.31.29 x_refsource_MISC