CVE-2026-114084: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in triggerdotdev trigger.dev

Trigger.dev prior to version 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint. The vulnerability arises because the tags query parameter is concatenated without proper escaping into the ElectricSQL shape where clause, which also defeats the runtimeEnvironmentId tenant guard. This allows authenticated attackers holding any project API key with read:runs scope to append boolean conditions to stream TaskRun records from every organization on the same self-hosted instance, potentially exposing sensitive payloads and metadata.

An attacker with a valid project API key and read:runs scope can exploit this vulnerability to bypass tenant isolation and access TaskRun records, including sensitive payloads and metadata, from all organizations hosted on the same self-hosted Trigger.dev instance. This could lead to unauthorized data disclosure across tenant boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects self-hosted instances, administrators should monitor vendor communications for an official fix and apply it promptly once available. Until then, restrict API key permissions and consider limiting access to trusted users only.