Skip to content
OpenAdvisories

Package · npm

trigger.dev

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-114088

    Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

    Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retriev…

    triggerdotdev trigger.dev trigger.dev npm
  • Medium 5.3
    CVE-2026-114086

    Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

    Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with…

    triggerdotdev trigger.dev trigger.dev npm
  • Medium 5.4
    CVE-2026-114079

    Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

    Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers wit…

    triggerdotdev trigger.dev trigger.dev npm
  • Medium 5.4
    CVE-2026-114076

    Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

    Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the w…

    triggerdotdev trigger.dev trigger.dev npm
  • Medium 5.5
    CVE-2026-114073

    Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

    Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support …

    triggerdotdev trigger.dev trigger.dev npm
  • Medium 5.4
    CVE-2026-85650

    Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

    Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs t…

    triggerdotdev trigger.dev trigger.dev npm