Security advisories

medium2026-10-02

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

GHSA-fj2x-mqqp-3v2w

medium2026-10-02

Trigger.dev: Cross-environment deployment cancel

GHSA-4672-hwv6-gq62

high2026-10-02

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

GHSA-9q4r-4842-93vw

medium2026-10-02

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

GHSA-59h8-w5q6-mfmp

high2026-10-02

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

GHSA-pqxw-g93w-hj9x

critical2026-10-02

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

GHSA-gg6r-gp4c-89hp

medium2026-10-02

Trigger.dev: Blind SSRF via alert-channel webhook

GHSA-q567-cr4x-96w4

high2026-10-02

Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

GHSA-pp95-gc86-jq6q

high2026-10-02

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

GHSA-xxv7-2vv3-h682

high2026-10-02

Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)

GHSA-qxpp-qjg8-x4jv

high2026-08-13

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

GHSA-p28v-f755-9qrg · CVE-2026-73654