Vulnerability Database

GHSA-fj2x-mqqp-3v2w

npm/trigger.dev

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values 17 hours ago

Fix available
Severity - 5.5 (Medium)

GHSA-4672-hwv6-gq62

npm/trigger.dev

Trigger.dev: Cross-environment deployment cancel 17 hours ago

Fix available
Severity - 5.4 (Medium)

GHSA-9q4r-4842-93vw

npm/trigger.dev

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name 17 hours ago

Fix available
Severity - 7.7 (High)

GHSA-59h8-w5q6-mfmp

npm/trigger.dev

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId 17 hours ago

Fix available
Severity - 5.3 (Medium)

GHSA-pqxw-g93w-hj9x

npm/trigger.dev

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise 17 hours ago

Fix available
Severity - 8.1 (High)

GHSA-gg6r-gp4c-89hp

npm/trigger.dev

Trigger.dev: V1 coordinator default-secret unauth Socket.IO 17 hours ago

Fix available
Severity - 9.2 (Critical)

GHSA-q567-cr4x-96w4

npm/trigger.dev

Trigger.dev: Blind SSRF via alert-channel webhook 17 hours ago

Fix available
Severity - 5.4 (Medium)

GHSA-pp95-gc86-jq6q

npm/trigger.dev

Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) 17 hours ago

Fix available
Severity - 7.1 (High)

GHSA-xxv7-2vv3-h682

npm/trigger.dev

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL 20 hours ago

Fix available
Severity - 7.7 (High)

GHSA-qxpp-qjg8-x4jv

npm/trigger.dev

Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) 20 hours ago

Fix available
Severity - 7.1 (High)

CVE-2026-92773

github.com/triggerdotdev/trigger.dev

Trigger.dev before 4.6.0 GitHub App Installation Takeover 16 Sep

Fix available
Severity - 7.1 (High)

CVE-2026-85651

github.com/triggerdotdev/trigger.dev

Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay 04 Sep

Fix available
Severity - 8.4 (High)

CVE-2026-85650

github.com/triggerdotdev/trigger.dev

Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel 04 Sep

Fix available
Severity - 5.3 (Medium)

CVE-2026-73659

github.com/triggerdotdev/trigger.dev

Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API 13 Aug

Fix available
Severity - 8.1 (High)

CVE-2026-73658

github.com/triggerdotdev/trigger.dev

Trigger.dev: Cross-tenant object store read and write via URL path traversal 13 Aug

Fix available
Severity - 8.2 (High)

CVE-2026-73657

github.com/triggerdotdev/trigger.dev

Trigger.dev: Cross-tenant payload poisoning via packet write + replay 13 Aug

Fix available
Severity - 4.2 (Medium)

Vulnerabilities