CVE-2026-85651
CVE-2026-85651 · Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
CVSS 8.4 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.2: Affected (semver)
Update to 4.5.2
trigger.dev npm
- Affected ranges
- SEMVER: < 4.5.2
Update to 4.5.2
Original sources
- https://github.com/triggerdotdev/trigger.dev/issues/4173
- https://github.com/triggerdotdev/trigger.dev
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-qxpp-qjg8-x4jv
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-unauthorized-environment-access-via-run-replay
- https://nvd.nist.gov/vuln/detail/CVE-2026-85651