A cross-tenant SQL injection vulnerability exists in trigger.dev's TSQL query compiler at the POST /api/v1/query endpoint. The vulnerability arises because the window-function name in the query is concatenated into the SQL string without allowlisting or escaping, allowing an authenticated customer to inject raw subqueries that bypass tenant isolation. This enables an attacker to read analytics data belonging to other tenants. The issue has been verified end-to-end against the real compiler and a live ClickHouse database.
Trigger.dev versions prior to 4.5.5 have an unauthenticated POST endpoint allowing arbitrary data injection into realtime streams by anyone who knows or can guess a run friendlyId. The endpoint lacks authentication and environment scoping, enabling cross-environment access. This vulnerability has a medium severity with a CVSS score of 5.3.
Self-hosted trigger.dev version 4 instances deployed with the default Docker Compose configuration using hardcoded secrets in the provided .env.example file are vulnerable to unauthenticated attacks. The MAGIC_LINK_SECRET allows attackers to forge authentication tokens and gain access as any user without email verification. This leads to automatic user creation and full access to infrastructure services including the database, Redis, and ClickHouse, all of which use default or no authentication. The vulnerability enables complete infrastructure compromise, including tenant data, API keys, encrypted secrets, and job queue manipulation.
Trigger.dev versions prior to 4.5.4 contain multiple critical vulnerabilities in the self-hosted coordinator Socket.IO namespace. A hardcoded default secret allows unauthenticated access, enabling attackers to retrieve decrypted environment variables from any run if they know the run's internal ID. Additionally, unauthenticated write handlers allow attackers to send forged messages affecting arbitrary runs. These issues were fully resolved by removing the vulnerable V1 execution stack and default secrets in version 4.5.4. Managed cloud deployments were not affected due to non-default secrets.
Trigger.dev contains a blind Server-Side Request Forgery (SSRF) vulnerability in its webhook alert channel implementation. Authenticated tenants can configure webhook URLs without validation, allowing the server to POST alert payloads to internal or metadata service IP addresses. This can lead to internal host scanning, state-changing POST requests to internal services, and potential access to IMDSv1 via redirects. The vulnerability affects versions prior to 4.5.2. A fix is available that includes validating webhook URLs against private, link-local, loopback, and metadata IP ranges and re-checking URLs at fetch time.
Trigger.dev contains an insecure direct object reference (IDOR) vulnerability in the run replay action function where no authentication or authorization checks are performed. This allows any authenticated user to replay task runs from any organization by knowing the run's friendlyId. A similar issue exists in the batch completion action, enabling unauthorized triggering of batch completions. The vulnerability enables cross-organization task execution with victim environment secrets, resource consumption, and potential data integrity issues. Patch is available.
The npm package 'ui-base-colors' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'translate-base-font' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'ui.dist.min.js' contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by the package.
CVE-2026-103918 is a medium severity vulnerability in the middleapi orpc package affecting the ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin. These plugins improperly handle object keys that match Object.prototype members, allowing an attacker to replace the prototype of a coerced input object or cause unhandled TypeErrors by sending keys like 'constructor'. The issue is limited to the request payload and does not affect global state or other requests. It is fixed in version 1.14.10.
The npm package '@smwebserver/static' version 99.9.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain known for malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No official patch or remediation information is provided.
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without a closing greater-than character. The synchronous parser converts and scans the full supplied buffer without an input cap, while the streaming parser reparses the complete accumulated SVG prefix for every received chunk. The probe.sync(), probe(stream), and probe(url) entry points can therefore block the Node.js event loop at full CPU, and attacker-controlled chunking can amplify the streaming cost. This issue is fixed in version 7.4.0.
Next.js versions from 15.0.0 up to but not including 15.5.27, and from 16.0.0 up to but not including 16.3.8, contain a vulnerability where a shared response cache key is insufficiently scoped. This allows an unauthenticated attacker to poison the cache via a crafted request, potentially causing cross-user content substitution or persistent denial of service until the cache entry is refreshed. The issue is fixed in versions 15.5.27 and 16.3.8.
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.
A Server-Side Request Forgery (SSRF) vulnerability exists in Next.js versions 16.0.0 through 16.3.7 in the Image Optimization feature when using images.remotePatterns. This allows attacker-controlled DNS resolution to bypass allow-list checks and fetch images from private IP addresses. Applications not using images.remotePatterns are not affected. The issue is fixed in version 16.3.8.
Next.js versions from 15.0.0 up to but not including 15.5.27, and from 16.0.0 up to but not including 16.3.8, contain a vulnerability where the response cache for statically generated or Incremental Static Regeneration pages using the Pages Router can be incorrectly keyed. This allows a request to replace one page's cached content with that of another route, causing incorrect content to be served to visitors until the cache is revalidated. Applications deployed on Vercel are not affected. The issue is fixed in versions 15.5.27 and 16.3.8.
CVE-2026-94544 is a medium severity vulnerability in Vercel's Next.js framework affecting versions >=16.3.0 and <16.3.8. It involves the use of a shared cache for pending `use cache` fills that does not distinguish between Draft Mode and regular requests. This can cause unpublished draft content to be served to unauthenticated users or published content to be served in draft previews. Additionally, if a regular request prerenders a page during this overlap, unpublished content may be persisted and served to all visitors until the page is revalidated.
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.
The npm package 'kartykgithub-ph-f' version 1.0.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
figlet.js versions prior to 1.11.3 contain a vulnerability where the text() and textSync() functions can enter an infinite loop if the whitespaceBreak option is enabled and the specified width is smaller than the width of a single FIGlet character. This occurs because the breakWord() function fails to find a valid break point and does not consume any input, causing generateFigTextLines() to repeatedly process the same input, leading to high CPU usage and memory growth. This issue is resolved in version 1.11.3.