Everything Patch Herald has reported about Trigger.dev: 3 stories, newest first. Part of our Vulnerabilities coverage.
Trigger.dev versions prior to 4.6.0 contain a high-severity authorization flaw that allows attackers to steal root API keys and admin tokens using limited credentials.
A high-severity vulnerability in Trigger.dev allows authenticated users to bypass tenant isolation and access other tenants' data via path traversal.
A high-severity CSRF vulnerability in Trigger.dev versions prior to 4.5.2 allows attackers to steal access tokens and hijack user accounts.