Trigger.dev versions from 4.4.2 until 4.5.0-rc.5 have an improper input validation vulnerability (CWE-20) combined with path traversal issues (CWE-22) and missing authorization checks (CWE-862) in the Aws4FetchClient component. Specifically, user-controlled packet keys are assigned to URL.pathname without rejecting dot segments, and path normalization collapses '..' segments before signing. The API accepts parameters without rejecting these segments and uses a resource finder that does not validate resource ownership. This allows an attacker with a valid environment API key to generate presigned URLs for object-store keys belonging to other tenants, enabling unauthorized read or overwrite of task payloads. The vulnerability is fixed in version 4.5.0-rc.5. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality and integrity impact, and no availability impact.

An attacker with a valid environment API key can exploit this vulnerability to obtain presigned URLs for object-store keys of other tenants, allowing unauthorized reading or overwriting of task payloads. This compromises confidentiality and integrity of data across tenant boundaries within the trigger.dev platform. There is no impact on availability. The vulnerability affects multi-tenant isolation and access control mechanisms.

The vendor manages remediation for this cloud-hosted service. The issue is fixed in trigger.dev version 4.5.0-rc.5. Users should ensure they are using version 4.5.0-rc.5 or later to mitigate this vulnerability. Patch status is confirmed as fixed starting from 4.5.0-rc.5. No additional mitigation steps are indicated by the vendor advisory.