trigger.dev vulnerabilities
CVEs whose affected-version data names the trigger.dev package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
40 CVEsRSS
GHSA-gg6r-gp4c-89hpCriticalTrigger.dev: V1 coordinator default-secret unauth Socket.IO
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
GHSA-59h8-w5q6-mfmpMedium· 5.3Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
GHSA-pqxw-g93w-hj9xHighTrigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
GHSA-9q4r-4842-93vwHigh· 7.7Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
GHSA-4672-hwv6-gq62Medium· 5.4Trigger.dev: Cross-environment deployment cancel
Trigger.dev: Cross-environment deployment cancel
GHSA-fj2x-mqqp-3v2wMedium· 5.5Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
GHSA-qxpp-qjg8-x4jvHigh· 7.1Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
GHSA-xxv7-2vv3-h682High· 7.7Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
CVE-2026-92773High· 7.1Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and sup…
CVE-2026-85651High· 8.5Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other orga…