trigger.dev — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in trigger.dev, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-92773	Trigger.dev before 4.6.0 GitHub App Installation Takeover CWE-639	7.1	High	2026-09-16
CVE-2026-85650	Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel CWE-918	5.4	Medium	2026-09-04
CVE-2026-85651	Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay CWE-862	8.5	High	2026-09-04
CVE-2026-73659	Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API CWE-22	8.1	High	2026-08-13
CVE-2026-73658	Trigger.dev: Cross-tenant object store read and write via URL path traversal CWE-20	8.2	High	2026-08-13
CVE-2026-73657	Trigger.dev: Cross-tenant payload poisoning via packet write + replay CWE-22	4.2	Medium	2026-08-13
CVE-2026-73656	Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state CWE-639	9.9	Critical	2026-08-13
CVE-2026-73655	Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login CWE-287	7.4	High	2026-08-13
CVE-2026-73654	Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS CWE-1321	8.5	High	2026-08-13

All 9 known CVE vulnerabilities affecting trigger.dev with full Chinese analysis, references, and POCs where available.