Blind SSRF Vulnerability in trigger.dev: Exploitable Webhook URL Handling
Summary
GHSA-q567-cr4x-96w4: Trigger.dev: Blind SSRF via alert-channel webhook. Affects trigger.dev versions < 4.5.2. Fixed in 4.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
trigger.dev is an open-source platform designed for managing alerts and notifications in web applications. It allows users to set up webhook alert channels that trigger notifications based on specific events, such as deployment failures. However, the handling of user-supplied URLs in these webhook channels has led to a significant security vulnerability, exposing the system to blind Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability arises from the lack of validation for user-supplied URLs in the webhook alert channel configuration. When an alert is triggered, the application sends a POST request to the specified URL without checking if the URL points to a safe or allowed host. This oversight allows authenticated users to direct the webhook to internal services or metadata endpoints, such as 169.254.169.254, potentially leading to unauthorized access to sensitive internal data. The vulnerability is classified under CWE-918, indicating a failure to validate the target of a request, which can lead to various security risks, including internal port scanning and state-changing requests to internal services.
How To Fix
Latest published version: 4.7.7 as of 22 Oct 2026
npm install trigger.dev@4.7.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.2
This is the first release that contains the fix.
npm install trigger.dev@4.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using internal or private IP addresses in webhook URLs. Instead, configure webhooks to point to external, publicly accessible endpoints. This can help mitigate the risk until a proper fix is applied.
Conclusion
The blind SSRF vulnerability in trigger.dev poses a significant risk due to improper handling of webhook URLs. By updating to the latest version and implementing proper URL validation, users can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of vulnerabilities.
See every vulnerability recorded for trigger.dev →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
The risks include unauthorized access to internal services, potential data leakage, and the ability to perform internal network reconnaissance.
Yes, a patch is available in version 4.5.2 of the trigger.dev package. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, ensure that webhook URLs do not point to internal or private IP addresses as a temporary measure to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for trigger.dev.
