CVE-2026-55239

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

CVE-2026-55239 Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

CVE-2026-55239

The Tianji open source analytics and monitoring platform is vulnerable to SQL Injection in versions prior to 1.31.29 . The root cause is located in the getDateQuery() function within src/server/utils/prisma.ts, which uses Prisma.sql() to construct raw SQL by interpolating the timezone value witho...

CVE-2026-55239

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

PT-2026-115108

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

MsgByte Tianji SQL Injection Vulnerability

Versions of MsgByte Tianji before 1.31.29 have a SQL injection vulnerability. This vulnerability stems from the getDateQuery function in src/server/utils/prisma.ts, which interpolates the timezone request value using Prisma.sql. Without parameter binding, attackers can inject SQL statements throu...