CVE-2026-55239

Status: DeferredHigh (8.8)—

Severity8.8High · CVSS 3.1

Exploitation probability0.34 %higher than 26% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.

CVSS

Base score: 8.8
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.34 %
Percentile among all scored CVEs: 26
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1005 Data from Local Systemcollection80 %
Secondary impactT1499 Endpoint Denial of Serviceimpact55 %
Secondary impactT1565.001 Stored Data Manipulationimpact75 %

Vector AV:N/PR:L (red con privilegios) y CWE-89: el valor timezone se concatena en SQL sin parametrizar, permitiendo SQL arbitrario que divulga o modifica credenciales y datos de tenants.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Remote Data Storage Network Segmentation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Tianji — Tianji^AI

CWEs

CWE-89

References

Show 3 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-55239",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "msgbyte",
          "product": "tianji",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.31.29"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-15T19:17:40.143",
  "references": [
    {
      "url": "https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/msgbyte/tianji/releases/tag/v1.31.29",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/msgbyte/tianji/security/advisories/GHSA-v9jm-vvrj-53c4",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29."
    }
  ],
  "lastModified": "2026-10-16T20:04:29.760",
  "sourceIdentifier": "security-advisories@github.com"
}