Trigger.dev: Cross-tenant SQL Injection In The TSQL Query Compiler (POST /api/v1/query) Via Unsanitized Window-function

Summary A cross-tenant SQL injection in the TSQL query compiler lets any authenticated trigger.dev customer read every other tenant's analytics data. The customer-facing query endpoint "POST /api/v1/query" accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by "internal-packages/tsql". T...

PT-2026-111191

Summary A cross-tenant SQL injection in the TSQL query compiler lets any authenticated trigger.dev customer read every other tenant's analytics data. The customer-facing query endpoint POST /api/v1/query accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by internal-packages/tsql. The...