CVE-2026-55240

Name of the Vulnerable Software and Affected Versions Tianji versions prior to 1.31.29

Description The formatString() function in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to the lodash template() function while the default evaluate pattern is enabled. A workspace administrator can store an evaluate block using the <% code %> format. When an unauthenticated user submits a response via the public survey.submit endpoint, the compiled template executes server-side JavaScript within the Node.js process. This can lead to remote command execution, disclosure of secrets, data modification, or service disruption.

Recommendations Update to version 1.31.29.