Exposed Secrets in Debug Logs of Trigger.dev Package
Summary
GHSA-fj2x-mqqp-3v2w: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values. Affects trigger.dev versions < 4.5.9. Fixed in 4.5.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Trigger.dev is a deployment tool that simplifies the process of deploying applications by managing environment variables and configurations. It is widely used for its ability to streamline CI/CD workflows. However, a recent vulnerability has been identified in version 4.5.3, where debug logs inadvertently expose sensitive environment variable values, including database connection strings and service credentials.
Vulnerability Detail
The vulnerability arises from the logging mechanism in Trigger.dev, specifically when executing a staging dry-run with debug logging enabled. The command 'trigger.dev deploy --env staging --dry-run --log-level debug' outputs a complete build-worker options object, including the 'envVars' property that contains unredacted sensitive values. This exposure allows anyone with access to the debug logs to recover sensitive deployment secrets, posing a significant security risk. The issue is exacerbated by the fact that users may reasonably expect that deployment logs will not print secrets, as non-debug outputs correctly hide these values.
How To Fix
Minimum fixed version
4.5.9
This is the first release that contains the fix.
npm install trigger.dev@4.5.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the debug log level when running deployment commands. Instead, use a standard log level to prevent sensitive information from being logged. For example, run the command without the '--log-level debug' option: 'trigger.dev deploy --env staging --dry-run'.
Conclusion
The vulnerability in Trigger.dev exposes sensitive environment variable values in debug logs, posing a security risk for users. It is crucial to update to version 4.5.9 or later to mitigate this issue. Users should also refrain from using debug logging until the update is applied.
See every vulnerability recorded for trigger.dev →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The exposed information includes unredacted environment variable values such as database connection strings and service credentials.
Yes, if an unauthorized user gains access to the debug logs, they could potentially exploit the exposed secrets, leading to a data breach.
If you cannot update immediately, ensure to avoid using debug logging in your deployment commands to minimize the risk of exposing sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for trigger.dev.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.