The vulnerability is in the trigger.dev TSQL query compiler's handling of window-function names. While most user inputs are parameterized or escaped, the window-function name is concatenated raw into the SQL query without allowlist checks or escaping. The lexer accepts backtick-quoted identifiers, allowing injection of arbitrary SQL subqueries. Tenant isolation is enforced only on the outer table's WHERE clause, which does not apply to injected subqueries. Authenticated users can exploit this by crafting a window-function name containing a subquery that accesses another tenant's data. The vulnerability was demonstrated with a proof-of-concept that injected a subquery selecting data from another tenant's table, which executed successfully on a live ClickHouse instance.

An authenticated trigger.dev customer can bypass tenant isolation and read analytics data belonging to other tenants. This results in unauthorized data disclosure across tenants, violating confidentiality. The vulnerability does not affect availability or integrity but allows high-severity data leakage.

A patch is available for this vulnerability. Users should apply the official fix provided by trigger.dev to ensure the window-function name is properly validated or escaped to prevent injection. Until patched, avoid using the vulnerable query endpoint or restrict access to trusted users only. Check the vendor advisory for the latest remediation guidance.