trigger.dev
v4.8.5Trigger.dev – build and deploy durable AI agents and workflows
- Maintenance
- Active837 commits in 3 months · bus factor 2
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 30 advisories16 high, 12 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
16.8k stars · 1.5k forks · 267 open issues · last release 3 days ago · data checked 41 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 16 high, 12 medium, 2 low. Check the patched version against the one you run.
- highGHSA-65rr-73jq-6qhfOct 20, 2026CLI login reactivates a revoked Personal Access Token
- Affected
- <= 4.7.4
- Patched in
- >= 4.7.4
- mediumGHSA-m79r-84cc-xwg9Oct 6, 2026Tenant filtering bypass in query table placeholders
- Affected
- <= 4.7.2
- Patched in
- >= 4.7.3
- highGHSA-qwrm-2cq8-xfr8Oct 2, 2026Authorize parent runs before attaching batch-created waitpoints
- Affected
- <= 4.7.0
- Patched in
- >= 4.7.0
- mediumGHSA-pc95-gc74-wg87Sep 16, 2026Public session tokens can overwrite own server-authored chat snapshots
- Affected
- <= 4.6.2
- Patched in
- >= 4.6.2
- highGHSA-jc26-22qp-cgqjSep 14, 2026Supervisor workload API lacks cross-tenant authentication
- Affected
- <= 4.6.0
- Patched in
- >= 4.6.0
- highGHSA-9rx3-j5hm-5f27Sep 14, 2026GitHub App installation-link takeover via missing installation-ownership verification
- Affected
- <= 4.6.0
- Patched in
- >= 4.6.0
- lowGHSA-wpp9-mq73-fhqmSep 14, 2026Dashboard Agent stores a delegated user token in session input records readable with the chat access token
- Affected
- <= 4.6.0
- Patched in
- >= 4.6.0
- highGHSA-4gjx-f5hj-678xSep 14, 2026Restricted additional API keys can read the environment root secret via the env-var dump
- Affected
- <= 4.6.0
- Patched in
- >= 4.6.0
- highGHSA-xrp6-5fpv-4fxfSep 14, 2026Missing run authorization allows cross-tenant suspension and resume-data injection
- Affected
- <= 4.6.0
- Patched in
- >= 4.6.0
- lowGHSA-m8pr-xr7c-frh3Sep 8, 2026Authenticated project members could complete another member’s development waitpoint using a known ID
- Affected
- <= 4.5.11
- Patched in
- >= 4.5.12
- mediumGHSA-hc5h-gqhc-4h79Aug 20, 2026Slack OAuth state is not session-bound, enabling integration CSRF
- Affected
- <= 4.5.11
- Patched in
- >= 4.5.12
- mediumGHSA-wpjq-q67r-pg6mAug 20, 2026Delegated user-actor token capability checks are bypassed by the legacy alert-channel API.
- Affected
- <= 4.5.11
- Patched in
- >= 4.5.12
- mediumGHSA-fhh4-xvj5-m7pqAug 7, 2026Webhook SSRF fix bypass via non-global 198.18.0.0/15 benchmarking range
- Affected
- <= 4.5.9
- Patched in
- >= 4.5.10
- mediumGHSA-fj2x-mqqp-3v2wJul 31, 2026Trigger CLI debug deployment logs expose resolved environment secret values
- Affected
- <=4.5.8
- Patched in
- >=4.5.9
- highGHSA-2gvw-9968-v578Jul 21, 2026Cross-tenant deployment hijack: createDeploymentBackgroundWorkerV4 resolves a WorkerDeployment by friendlyId alone (no env/project/org scope) -> an attacker with only their own env API key re-points any other tenants in-progress deployment at a worker in the attackers environment
- Affected
- <= 4.5.5
- Patched in
- >= 4.5.6
- mediumGHSA-4672-hwv6-gq62Jul 21, 2026Cross-environment deployment cancel: a lower-trust env key (dev/preview/CI) cancels another environment’s (e.g. production) deployments — DeploymentService.getDeployment scopes by projectId only, not environmentId
- Affected
- <= 4.5.5
- Patched in
- >= 4.5.6
- highGHSA-h4pj-26m5-j4r3Jul 21, 2026Cross-organization schedule delete/disable: DeleteTaskScheduleService & SetActiveOnTaskScheduleService check membership on the callers own project then resolve the schedule by friendlyId with no projectId scope -> any org member destroys any other orgs IMPERATIVE cron schedules
- Affected
- <= 4.5.6
- Patched in
- >= 4.5.6
- highCVE-2026-73654Jul 21, 2026Prototype pollution via run metadata operations → process-wide cross-tenant DoS (CWE-1321)
- Affected
- >= v3.3.8, <= 4.5.5
- Patched in
- >= 4.5.6
- highGHSA-9q4r-4842-93vwJul 21, 2026Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
- Affected
- <= 4.5.5
- Patched in
- >= 4.5.6
- highGHSA-cpx8-cffg-mp4wJul 21, 2026Overly broad realtime session credentials allow cross-session stream modification and deletion
- Affected
- < 4.6.2
- Patched in
- >= 4.6.2
- mediumGHSA-2cqj-rq4j-8835Jul 21, 2026CSRF Logout
- Affected
- <= 4.5.5
- Patched in
- >= 4.5.6
- highGHSA-p6j2-2fjh-vc8vJul 21, 2026Cross-tenant task-run read via tags where-clause injection in realtime API
- Affected
- <= 4.5.5
- Patched in
- >= 4.5.6
- mediumGHSA-59h8-w5q6-mfmpJul 21, 2026Unauthenticated Realtime Stream Data Injection via Run FriendlyId
- Affected
- <= 4.5.4
- Patched in
- >= 4.5.5
- highGHSA-pqxw-g93w-hj9xJul 21, 2026Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
- Affected
- <= 4.5.5
- Patched in
- >= 4.5.6
- highGHSA-pqmg-rq46-vm4mJul 21, 2026trigger dev --mcp MCP server binds default network interface and exposes /sse + /messages without authentication, allowing reachable callers to invoke MCP tools that operate against the developer's stored Trigger.dev access token
- Affected
- >= 3.0.0
- Patched in
- >= 4.5.4
- mediumGHSA-gg6r-gp4c-89hpJul 20, 2026V1 coordinator default-secret unauth Socket.IO
- Affected
- < 4.5.4
- Patched in
- 4.5.4
- highGHSA-gx7f-q62h-9fxpJul 9, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in triggerdotdev/trigger.dev
- Affected
- <= 4.4.6
- Patched in
- >= 4.5.0-rc.3
- mediumGHSA-q567-cr4x-96w4Jul 9, 2026Blind SSRF via alert-channel webhook: the webapp server POSTs HMAC-signed alert payloads to a user-set URL with no host allowlist / private-IP block (url validated only as z.string().optional())
- Affected
- <= 4.5.1
- Patched in
- >= 4.5.2
- mediumGHSA-2wgf-7gx2-hcpwJul 9, 2026SSRF via unvalidated alert-channel webhook URL
- Affected
- <=4.5.1
- Patched in
- >= 4.5.2
- highCVE-2026-73655Jul 9, 2026Account Takeover via Cross-Provider OAuth Email Matching in Google Login
- Affected
- <= 4.5.1
- Patched in
- >= 4.5.2