CVE-2026-85650
CVE-2026-85650 · Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
CVSS 5.3 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
trigger.dev
- Versions du logiciel
- ≥ 0, < 4.5.2: Concernée (semver)
Mettez à jour vers 4.5.2
trigger.dev npm
- Plages de versions concernées
- SEMVER: < 4.5.2
Mettez à jour vers 4.5.2
Sources originales
- https://github.com/triggerdotdev/trigger.dev/issues/4172
- https://github.com/triggerdotdev/trigger.dev
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-server-side-request-forgery-via-webhook-alert-channel
- https://nvd.nist.gov/vuln/detail/CVE-2026-85650