EUVD-2026-106887

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key...

CVE-2026-114084

Trigger.dev versions before 4.5.6 are vulnerable to an SQL injection in the /realtime/v1/runs endpoint. The root cause is the concatenation of the unescaped tags query parameter into the ElectricSQL shape where clause, which bypasses the runtimeEnvironmentId tenant guard. Authenticated attackers ...