trigger.dev
npm9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting trigger.devpage 1 of 1
- CVE-2026-114073MEDIUMCVSS 5.5EG 5.5fixed in 4.5.92026-10-21
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI deb…
- CVE-2026-114076MEDIUMCVSS 5.4EG 5.4fixed in 4.5.22026-10-21
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attac…
- CVE-2026-114079MEDIUMCVSS 5.4EG 5.4fixed in 4.5.62026-10-21
Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId…
- CVE-2026-114081HIGHCVSS 7.7EG 7.7fixed in 4.5.62026-10-21
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a back…
- CVE-2026-114086MEDIUMCVSS 5.3EG 5.3fixed in 4.5.52026-10-21
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:…
- CVE-2026-114087HIGHCVSS 8.1EG 8.1fixed in 4.5.62026-10-21
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unaut…
- CVE-2026-114088MEDIUMCVSS 6.5EG 6.5fixed in 4.5.42026-10-21
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_…
- CVE-2026-85650MEDIUMCVSS 5.4EG 5.4fixed in 4.5.22026-09-04
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert …
- CVE-2026-85651HIGHCVSS 8.5EG 8.5fixed in 4.5.22026-09-04
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organi…
Check whether trigger.dev is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for trigger.dev CVEs against the assets you own.
Book a Demo →