Tianji EUVD-2026-102246

Exploitation requires an attacker with Tianji workspace-administrator privileges to store the payload: a lodash evaluate block written in the '<% code %>' form inside a survey feedTemplate (or a monitor notification template) handled by formatString() in src/server/utils/template.ts. It further requires that the survey feature is in use with a reachable public survey.submit endpoint, and that the default lodash evaluate pattern remains enabled (the default behavior in all versions prior to 1.31.29). Rendering - and thus code execution - is triggered when any unauthenticated user submits a survey response, so no victim admin interaction is needed to fire the payload. The key limiting factor is the workspace-admin requirement to plant the template; a purely external, unprivileged attacker cannot inject the code themselves. Fixed in 1.31.29.

The headline CVSS is 9.1 (Critical) with AV:N/AC:L/UI:N, which looks like a trivially-remotable RCE, but the single most important signal is PR:H: the attacker must already hold workspace-administrator privileges to store the malicious evaluate block in a survey feedTemplate or monitor notification template. That substantially tempers real-world risk - this is primarily a privilege-escalation / sandbox-escape for an already-trusted operator rather than a pre-auth internet-facing RCE. The S:C (scope change) and C:H/I:H/A:H are justified: server-side JavaScript runs in the Tianji Node.js process, escaping the logical workspace boundary to compromise the host and other tenants. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so exploitation is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. Note a data caveat: the provided 'source code evidence' commit diff shows SQL-identifier-quoting (SQL injection) hardening in the AIGateway insights builder and a survey snapshot change - it does NOT actually show the SSTI fix (disabling the lodash evaluate pattern in formatString()), so the referenced commit appears to bundle multiple security fixes; the template fix itself is not visible in the supplied diff. Overall: a genuine high-severity flaw, but its real priority is bounded by the workspace-admin prerequisite and absence of any exploitation/EPSS/KEV signal.

A malicious or compromised workspace administrator stores a survey feedback template containing a lodash evaluate block of the form '<% ...JavaScript... %>'. When any unauthenticated visitor submits a response via the public survey.submit endpoint, formatString() renders the template through lodash template() with the default evaluate pattern enabled, executing the attacker's JavaScript inside the Tianji Node.js process and yielding command execution, secret disclosure, or data tampering. No public proof-of-concept was identified at time of analysis.