Security Advisories · triggerdotdev/trigger.dev · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

Server-side request forgery via unvalidated webhook alert-channel URL
GHSA-xxv7-2vv3-h682 published Jul 9, 2026 by carderne

High
Cross-project deployment worker registration can modify another project's deployment state
GHSA-j6vv-pq9h-f4wj published Jul 9, 2026 by carderne

Critical
Cross-tenant task-run read via tags where-clause injection in realtime API
GHSA-p6j2-2fjh-vc8v published Jul 21, 2026 by carderne

High
Cross-tenant object read/write via path traversal in packet presign API
GHSA-m3mf-37q7-8928 published Jul 9, 2026 by carderne

High
Supervisor workload API lacks cross-tenant authentication
GHSA-jc26-22qp-cgqj published Sep 14, 2026 by carderne

High
Unauthenticated Realtime Stream Data Injection via Run FriendlyId
GHSA-59h8-w5q6-mfmp published Jul 21, 2026 by carderne

Moderate
Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
GHSA-pqxw-g93w-hj9x published Jul 21, 2026 by carderne

High
V1 coordinator default-secret unauth Socket.IO
GHSA-gg6r-gp4c-89hp published Jul 20, 2026 by carderne

Moderate
Cross-tenant payload poisoning via packet write + replay
GHSA-jx48-qfwm-xq67 published Jul 9, 2026 by carderne

Moderate
Cross-tenant object store read and write via URL path traversal
GHSA-888c-px7m-736v published Jul 9, 2026 by carderne

High