Skip to content
OpenAdvisories

Package · npm

trigger.dev

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.1
    CVE-2026-114087

    Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

    Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers…

    triggerdotdev trigger.dev trigger.dev npm
  • High 7.7
    CVE-2026-114081

    Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

    Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifi…

    triggerdotdev trigger.dev trigger.dev npm
  • High 7.1
    GHSA-pp95-gc86-jq6q

    Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

    ### Summary The run replay `action` function at `apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts` has no authentication or authorization check. While the `loader` (GET) in the same file properly calls `requireUser(request)` and scopes queries to…

    trigger.dev npm
  • High 8.5
    CVE-2026-85651

    Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

    Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects…

    triggerdotdev trigger.dev trigger.dev npm