GHSA-4672-HWV6-GQ62 Trigger.dev: Cross-environment deployment cancel

Summary Trigger.dev isolates each project into multiple environments dev, staging, prod, and per-PR preview branches, each with its own secret API key — the environment is a trust boundary a dev/preview/CI key is lower-trust than a prod key. Most API routes enforce this by scoping resource lookup...

CVE-2026-73659: Improper Limitation of a Pathname to a Restricted Directory

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-73655: Improper Authentication

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...