CVE-2026-114084: falha de alta gravidade em triggerdotdev trigger.dev
Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.3%
probabilidade de exploração
0.3%top 81% das CVEs
exploração observada
nãonenhuma fonte reporta
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
triggerdotdev · trigger.devCVEs relacionadas — triggerdotdev trigger.dev
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.6%CVE-2026-73659HIGHTrigger.dev: Cross-tenant object read/write via path traversal in packet presign APIEPSS 0.5%CVE-2026-73656CRITICALTrigger.dev: Cross-project deployment worker registration can modify another project's deployment stateEPSS 0.5%CVE-2026-85651HIGHTrigger.dev before 4.5.2 Unauthorized Environment Access via Run ReplayEPSS 0.5%CVE-2026-73655HIGHTrigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google LoginEPSS 0.5%CVE-2026-114092HIGHTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay ActionEPSS 0.4%