Advisories · Technology
triggerdotdev trigger.dev.
Every CVE that names triggerdotdev trigger.dev among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint
- triggerdotdev trigger.dev
- Cross-site request forgery (CSRF)
- CVSS 8.3 High
Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
- triggerdotdev trigger.dev
- Authentication bypass
- CVSS 6.0 Medium
Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route
- triggerdotdev trigger.dev
- Broken access control
- CVSS 8.7 High
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
- triggerdotdev trigger.dev
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
- triggerdotdev trigger.dev
- Authentication bypass
- CVSS 8.3 High
Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
- triggerdotdev trigger.dev
- SQL injection
- CVSS 8.6 High
Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints
- triggerdotdev trigger.dev
- Path traversal
- CVSS 7.2 High
Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
- triggerdotdev trigger.dev
- Broken access control
- CVSS 5.3 Medium
Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL
- triggerdotdev trigger.dev
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup
- triggerdotdev trigger.dev
- Broken access control
- CVSS 6.1 Medium
Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4
- triggerdotdev trigger.dev
- Broken access control
- CVSS 5.3 Medium
Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API
- triggerdotdev trigger.dev
- Broken access control
- CVSS 5.3 Medium
Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range
- triggerdotdev trigger.dev
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
- triggerdotdev trigger.dev
- Cross-site request forgery (CSRF)
- CVSS 2.3 Low
Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
- triggerdotdev trigger.dev
- Broken access control
- CVSS 5.1 Medium
Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records
- triggerdotdev trigger.dev
- Hard-coded credentials
- CVSS 8.6 High
Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
- triggerdotdev trigger.dev
- Privilege escalation
- CVSS 7.2 High
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
- triggerdotdev trigger.dev
- Broken access control
- CVSS 7.1 High
Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route
- triggerdotdev trigger.dev
- Broken access control
- CVSS 7.2 High
Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
- triggerdotdev trigger.dev
- Broken access control
- CVSS 7.1 High
Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
- triggerdotdev trigger.dev
- SQL injection
- CVSS 7.1 High
Trigger.dev before 4.6.0 GitHub App Installation Takeover
- triggerdotdev trigger.dev
- Broken access control
- CVSS 8.1 High
Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API
- triggerdotdev trigger.dev
- Path traversal
- CVSS 8.2 High
Trigger.dev: Cross-tenant object store read and write via URL path traversal
- triggerdotdev trigger.dev
- Path traversal
- Broken access control
- CVSS 4.2 Medium
Trigger.dev: Cross-tenant payload poisoning via packet write + replay
- triggerdotdev trigger.dev
- Path traversal
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
- triggerdotdev trigger.dev
- Broken access control
- CVSS 7.4 High
Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login
- triggerdotdev trigger.dev
- Authentication bypass