CVE-2026-55239 msgbyte CVE debrief

Who should care

Defenders responsible for Tianji deployments, particularly those with exposed instances or sensitive data, should assess exposure and prioritize patching. They should also review and restrict access to the shared PostgreSQL database and monitor for suspicious database activity. Additionally, defenders should verify affected versions and review access controls to prevent potential data breaches or service disruptions.

Why it matters

CVE-2026-55239 is a high-severity SQL injection vulnerability in Tianji that allows attackers to execute arbitrary SQL, potentially disclosing or modifying sensitive data, or making the service unavailable. Defenders should prioritize patching to version 1.31.29 or later, review and restrict access to the shared PostgreSQL database, and monitor for suspicious database activity.

• Potential data disclosure or modification
• Possible service unavailability
• Need for verification of affected versions and remediation

Technical summary

The getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. This allows an attacker to execute arbitrary SQL against the shared PostgreSQL database, potentially disclosing or modifying sensitive data, or making the service unavailable. The vulnerability is due to the lack of parameter binding in the Prisma.sql() function, which enables SQL injection attacks. Defenders should prioritize patching to prevent potential SQL injection attacks.

Defensive priority

Defenders should prioritize patching to prevent potential SQL injection attacks.

Recommended defensive actions

• Patch Tianji to version 1.31.29 or later
• Review and restrict access to the shared PostgreSQL database
• Monitor for suspicious database activity
• Verify affected versions and review access controls
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or impact is limited. There is no evidence of public exploitation, but defenders should verify affected versions and review access controls. The Tianji platform's use of Prisma.sql() without parameter binding allows for SQL injection attacks. Limited information is available on potential data disclosure or modification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.