trigger.dev
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 10 advisory(ies) without a verdict
Advisories (10)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-4672-hwv6-gq62 Trigger.dev: Cross-environment deployment cancel | < 4.5.6 | Undetermined |
| GHSA-59h8-w5q6-mfmp Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId | < 4.5.5 | Undetermined |
| GHSA-9q4r-4842-93vw Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name | < 4.5.6 | Undetermined |
| GHSA-fj2x-mqqp-3v2w Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values | < 4.5.9 | Undetermined |
| GHSA-gg6r-gp4c-89hp Trigger.dev: V1 coordinator default-secret unauth Socket.IO | < 4.5.4 | Undetermined |
| GHSA-pp95-gc86-jq6q Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) | < 4.5.2 | Undetermined |
| GHSA-pqxw-g93w-hj9x Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise | < 4.5.6 | Undetermined |
| GHSA-q567-cr4x-96w4 Trigger.dev: Blind SSRF via alert-channel webhook | < 4.5.2 | Undetermined |
| GHSA-qxpp-qjg8-x4jv Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) | < 4.5.2 | Undetermined |
| GHSA-xxv7-2vv3-h682 Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL | < 4.5.2 | Undetermined |
Sources
| Source | Licence |
|---|