npm/trigger.dev

Trigger.dev: Cross-environment deployment cancel

Modified: 10/21/2026

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Modified: 10/21/2026

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

Modified: 10/21/2026

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Modified: 10/21/2026

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

Modified: 10/21/2026

Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

Modified: 10/21/2026

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Modified: 10/21/2026

Trigger.dev: Blind SSRF via alert-channel webhook

Modified: 10/21/2026

Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)

Modified: 10/2/2026

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

Modified: 10/2/2026