CVE-2026-85651

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.

Trigger.dev from version 4.4.2 to 4.5.0 has a vulnerability in packet presign routes where a caller-controlled filename is passed to generate presigned URLs, allowing directory traversal to escape the object-store prefix and enabling a project API key to read or overwrite another organization's offloaded task payloads on multi-organization self-hosted instances.

Trigger.dev from version 4.4.2 to 4.5.0-rc.5 has a vulnerability in Aws4FetchClient.buildUrl() and presign() where user-controlled packet keys are assigned to URL.pathname, and the route accepts params without rejecting dot segments and without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads.

Trigger.dev from version 4.4.2 to 4.5.0-rc.4 has a vulnerability in the POST /api/v1/runs/:runParam/replay endpoint. The database query does not filter by runtimeEnvironmentId, allowing any valid environment API key to replay another tenant's run by friendlyId. Additionally, when payloadType "application/store" is used, payload bytes can be overwritten by an attacker, leading to unauthorized actions.

Trigger.dev before version 4.5.2 contains a vulnerability in addGoogleStrategy() that passes a Google profile email to findOrCreateGoogleUser() without requiring Google's email_verified assertion. When an existing email-matched account exists, an attacker can take over the account using an unverified matching email from their own Google profile.

Trigger.dev from version 3.3.8 to 4.5.6 contains a vulnerability in the PUT /api/v1/runs/:runId/metadata endpoint, where operation.key values are passed to new JSONHeroPath(operation.key).set() without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service.