CVE-2026-55239

Name of the Vulnerable Software and Affected Versions Tianji versions prior to 1.31.29

Description The getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL using Prisma.sql() by interpolating the timezone request value without parameter binding. This allows the timezone value to reach analytics queries via request data or the timezone HTTP header. Since workspaceProcedure allows any authenticated workspace member, including read-only viewers, to access these queries, an attacker can execute arbitrary SQL against the shared PostgreSQL database. This could lead to the disclosure or modification of credentials, API keys, and tenant data, or result in a denial of service.

Recommendations Update to version 1.31.29.