Tianji
Monthly
Server-side template injection in Tianji (msgbyte/tianji) before version 1.31.29 allows an attacker who already holds workspace-administrator privileges to execute arbitrary JavaScript inside the Tianji Node.js process by storing a lodash evaluate block ('<% code %>') in a survey feedTemplate or a monitor notification template. Because formatString() in src/server/utils/template.ts leaves the default lodash evaluate pattern enabled, the planted payload is rendered - and runs - when any unauthenticated user submits a response to the public survey.submit endpoint, so no victim administrator interaction is required to trigger it. The result can be command execution, secret disclosure, data modification, or service disruption; the vendor rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the practical limiting factor is the workspace-admin prerequisite rather than any external exploitability. There is no public exploit identified at time of analysis and the issue is fixed in version 1.31.29.
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.
Server-side template injection in Tianji (msgbyte/tianji) before version 1.31.29 allows an attacker who already holds workspace-administrator privileges to execute arbitrary JavaScript inside the Tianji Node.js process by storing a lodash evaluate block ('<% code %>') in a survey feedTemplate or a monitor notification template. Because formatString() in src/server/utils/template.ts leaves the default lodash evaluate pattern enabled, the planted payload is rendered - and runs - when any unauthenticated user submits a response to the public survey.submit endpoint, so no victim administrator interaction is required to trigger it. The result can be command execution, secret disclosure, data modification, or service disruption; the vendor rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the practical limiting factor is the workspace-admin prerequisite rather than any external exploitability. There is no public exploit identified at time of analysis and the issue is fixed in version 1.31.29.
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.