Description
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| triggerdotdev | trigger.dev | < 4.5.10 | 4.5.10 |
References
- GitHub Security Advisory (GHSA-fhh4-xvj5-m7pq) vendor-advisory
- VulnCheck Advisory: Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range third-party-advisory