Threat Intelligence Database

Trigger.dev versions before 4.6.0 contain an authorization bypass vulnerability where the application fails to verify that an authenticated user controls a GitHub App installation before associating it with their organization. This flaw allows attackers to claim another user's GitHub App installation by replaying state cookies and using sequential installation IDs, potentially gaining unauthorized access to the victim's repositories.

Trigger.dev versions from 4.4.2 up to but not including 4.5.0 contain a path traversal vulnerability in the packet presign routes. This flaw allows a caller-controlled filename to escape the intended restricted directory, enabling unauthorized read or overwrite access to other organizations' offloaded task payloads and outputs in multi-organization self-hosted instances. The vulnerability is fixed in version 4.5.0.

CVE-2026-73658 is a high-severity vulnerability in trigger.dev, a platform for building and deploying AI agents and workflows. Versions from 4.4.2 up to but not including 4.5.0-rc.5 have improper input validation in Aws4FetchClient methods that assign user-controlled keys to URL pathnames. This allows an attacker with a valid environment API key to bypass path normalization and obtain presigned URLs for other tenants' object-store keys, potentially reading or overwriting task payloads. The issue is fixed starting in version 4.5.0-rc.5. The vulnerability involves CWE-20 (Improper Input Validation), CWE-22 (Path Traversal), and CWE-862 (Missing Authorization).

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant's run by friendlyId, consuming victim resources and repeating side effects; when `payloadType: "application/store"` is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4.

Trigger.dev versions prior to 4.5.6 contain an authorization bypass vulnerability in the background worker deployment API. The flaw allows a user with a valid API key for one project to manipulate deployment identifiers from another project, linking an attacker-controlled background worker to a victim deployment and changing its state from BUILDING to DEPLOYING. This issue is resolved in version 4.5.6.

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.

Trigger.dev versions prior to 4.5.6 contain a prototype pollution vulnerability in the PUT /api/v1/runs/:runId/metadata endpoint. This flaw allows an attacker with a normal environment API key to modify Object.prototype in the shared webapp process, leading to corruption of Prisma queries and Prometheus labels, breaking authentication for other tenants, and causing a process-wide denial of service. The vulnerability is fixed in version 4.5.6.