Tianji, an open source analytics platform, contains a vulnerability in its template engine where the default evaluate pattern remains active. This permits a workspace administrator to embed arbitrary JavaScript code in survey feed templates using the <% code %> syntax. When an unauthenticated user submits a survey response, the server renders the template and executes the code within the Node.js process. As a result, an attacker can run system commands, exfiltrate secrets, modify data, or cause service disruption. The weakness is classified as CWE‑1336, which highlights improper handling of template evaluation leading to code execution. The described impact is therefore complete loss of confidentiality, integrity and availability on an affected server.

All installations of Tianji with a version earlier than 1.31.29 are vulnerable. The issue was identified in the template code within src/server/utils/template.ts, which processes survey feedTemplate and monitor notification templates before reaching the 1.31.29 release. Administrators controlling a workspace can deploy malicious template content, and any unauthenticated submitter may trigger its execution. Version 1.31.29 and subsequent releases have applied the fix.

The CVSS score of 9.1 indicates critical severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at this time. The vulnerability is not yet listed in the CISA KEV catalog, which implies no confirmed exploit has been reported. The likely attack vector is via the public survey.submit endpoint, where an unauthenticated request to submit survey data triggers server-side rendering of a malicious template. The exploit requires that the attacker can influence the template content; this is feasible for a workspace administrator or any user able to submit a survey with a crafted template.