Description
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| triggerdotdev | trigger.dev | < 4.6.0 | 4.6.0 |
References
- GitHub Security Advisory (GHSA-xrp6-5fpv-4fxf) vendor-advisory
- VulnCheck Advisory: Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint third-party-advisory