{"metadata": {"vulnerability": "CVE-2026-55240", "count": 9, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-06-16T16:44:00.624Z", "date_only": false, "value": "2026-06-16T16:44:00.624Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-55240", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T18:15:12.957Z", "date_only": false, "value": "2026-10-15T18:15:12.957Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55240", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T18:15:12.957Z", "date_only": false, "value": "2026-10-15T18:15:12.957Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-55240", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T18:15:12.957Z", "date_only": false, "value": "2026-10-15T18:15:12.957Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-55240", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T18:34:22.782Z", "date_only": false, "value": "2026-10-15T18:34:22.782383Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117446361863895467", "record": "CVE-2026-55240", "field": "creation_timestamp", "uuid": "80f3b3ab-15d5-4776-b0fe-73b6c147b4d4", "content": "CVE-2026-55240 Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store an evaluate block using the <% code %> form, and the public survey.submit endpoint renders a survey template when an unauthenticated user submits a response. The compiled template executes server-side JavaScript in the Tianji Node.js process, allowing command execution, secret disclosure, data modification, or service disruption. This issue is fixed in version 1.31.29.\nhttps://www.cve.org/CVERecord?id=CVE-2026-55240https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpmhttps://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48https://github.com/msgbyte/tianji/releases/tag/v1.31.29#msgbyte #tianji#CVE_2026_55240#bot", "url": "https://infosec.exchange/users/cve/statuses/117446361863895467"}, {"timestamp": "2026-10-15T19:17:40.290Z", "date_only": false, "value": "2026-10-15T19:17:40.290", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55240", "record": "FKIE_CVE-2026-55240", "field": "published"}, {"timestamp": "2026-10-15T19:50:05.803Z", "date_only": false, "value": "2026-10-15T19:50:05.803251Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxwthems3n2n", "record": "CVE-2026-55240", "field": "creation_timestamp", "uuid": "a38cbd20-417c-4c8b-be4d-48d2b1cfdc31", "content": "CVE-2026-55240\nVersions of Tianji prior to 1.31.29 allow a workspace administrator to place code in a survey or notification template that is then executed on the server when anyone submits a survey response. This can let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxwthems3n2n"}, {"timestamp": "2026-10-15T20:08:12.572Z", "date_only": false, "value": "2026-10-15T20:08:12.572660Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxwuhqosvq2o", "record": "CVE-2026-55240", "field": "creation_timestamp", "uuid": "d983b78a-a7cf-4952-a751-02857cc214c9", "content": "\ud83d\udea8 CVE-2026-55240 \u2014 CVSS 9.1 CRITICAL\n\nTianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, format...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-55240\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxwuhqosvq2o"}, {"timestamp": "2026-10-16T20:04:29.760Z", "date_only": false, "value": "2026-10-16T20:04:29.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55240", "record": "FKIE_CVE-2026-55240", "field": "lastModified"}]}