Tianji SQL Injection Patch Available for Versions Below 1.31.29

The open-source analytics and uptime monitoring platform Tianji has released version 1.31.29 to address a high-severity SQL injection vulnerability. This update fixes a flaw in earlier versions that allowed attackers to execute arbitrary SQL commands against the underlying database.

What happened

According to the National Vulnerability Database, CVE-2026-55239 carries a CVSS score of 8.8, classifying it as high severity. The flaw exists in the `getDateQuery()` function within the `src/server/utils/prisma.ts` file of Tianji versions earlier than 1.31.29. The function constructs raw SQL statements using Prisma.sql() by directly interpolating timezone request values without employing parameter binding. This unsafe construction method occurs when the timezone value reaches affected analytics queries through request data or the timezone HTTP header. The NVD record identifies the underlying weakness as CWE-89, which pertains to SQL injection issues.

The vulnerability was discovered in msgbyte tianji, an open-source platform used for server status monitoring and analytics. Prior to the release of the fix, any authenticated workspace member could exploit this issue. This includes users with read-only viewer permissions, as the `workspaceProcedure` permits these accounts to reach the vulnerable queries. An attacker leveraging this flaw can execute arbitrary SQL against the shared PostgreSQL database that hosts the application.

Successful exploitation of CVE-2026-55239 can lead to significant data compromise or service disruption. According to the source material, an attacker can disclose or modify credentials, API keys, and tenant data stored in the database. The arbitrary SQL execution capability also allows an attacker to make the service unavailable, resulting in a denial of service condition. The vendor has addressed this issue by releasing version 1.31.29, which corrects the improper SQL construction.

Why it matters

This vulnerability is particularly concerning because it does not require administrative privileges to exploit. Any authenticated user within a workspace, including those with minimal read-only access, can trigger the SQL injection. This broad attack surface increases the likelihood of exploitation, especially in environments where multiple users share access to the monitoring platform. The ability to extract or modify API keys and credentials poses a direct threat to the security of connected systems and tenant data.

The use of raw SQL construction without parameter binding represents a fundamental security oversight in application development. By failing to sanitize the timezone input, the application inadvertently grants attackers a direct line to the database engine. This flaw highlights the risks of improper input handling in server-side utility functions. Organizations relying on Tianji for uptime monitoring must prioritize this update to prevent potential data breaches or service outages caused by malicious SQL commands.

What to watch

• Monitor vendor announcements for any future updates to Tianji that might address related security concerns
• Review database logs for unusual SQL queries or unexpected changes to credentials and API keys
• Verify that all workspace members have appropriate access levels and follow the principle of least privilege

Who needs to act first

Teams should prioritize updating systems that are exposed to the internet or accessible to external users. Identify all instances of Tianji running versions below 1.31.29 and schedule immediate updates. Before applying the fix in production environments, test the update in a staging area to ensure compatibility with existing configurations. Back up database contents and application settings prior to performing the upgrade. If immediate updating is not possible, restrict network access to the application and monitor for suspicious activity. Coordinate with database administrators to review logs for signs of exploitation during the transition period.

Background: APIs

APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.

Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches

What to do and how to stay safe: Tianji

• Inventory all deployments of Tianji to identify systems running versions prior to 1.31.29
• Apply the update to version 1.31.29 as soon as possible to patch the SQL injection vulnerability
• Review database integrity and check for unauthorized changes to credentials or API keys after patching
• Enforce strict access controls for workspace members to limit potential exploitation surfaces

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-55239?

The CVSS score for CVE-2026-55239 is 8.8, which is classified as high severity.

Which versions of Tianji are affected by this vulnerability?

All versions of Tianji prior to 1.31.29 are affected by this SQL injection vulnerability.

Is there a fix available for this vulnerability?

Yes, version 1.31.29 of Tianji includes a fix for CVE-2026-55239.