Unauthenticated Realtime Stream Data Injection in Trigger.dev
Summary
GHSA-59h8-w5q6-mfmp: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId. Affects trigger.dev versions < 4.5.5. Fixed in 4.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Trigger.dev is an open-source platform that facilitates the management and execution of real-time data streams. It allows developers to create and manage workflows that can respond to events in real-time. However, a significant vulnerability exists in its handling of authentication for certain endpoints, which can lead to unauthorized data manipulation.
Vulnerability Detail
The vulnerability arises from the POST handler for /realtime/v1/streams/:runId/:streamId, which lacks authentication. This means that any user who knows or can guess a run's friendlyId can inject arbitrary data into its corresponding real-time stream. The issue is exacerbated by the predictable nature of run friendlyIds, such as run_1234abcd, making it easier for malicious actors to exploit this flaw. The vulnerability allows for cross-environment access, as the runtimeEnvironmentId is not checked, leading to potential data integrity issues.
How To Fix
Latest published version: 4.7.7 as of 22 Oct 2026
npm install trigger.dev@4.7.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.5
This is the first release that contains the fix.
npm install trigger.dev@4.5.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement your own authentication layer for the affected endpoint until the package is updated. For example, you could add a middleware function to check for valid authentication tokens before allowing access to the POST handler.
Conclusion
The unauthenticated data injection vulnerability in Trigger.dev poses a significant risk to applications using this package. It is crucial to update to the patched version 4.5.5 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for trigger.dev →
FAQ
The vulnerability allows unauthenticated users to inject data into real-time streams by exploiting the lack of authentication in specific API endpoints.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The potential impacts include unauthorized data manipulation, data integrity issues, and possible exposure of sensitive information across different environments.
Yes, a patch is available in version 4.5.5 of the Trigger.dev package. Updating to this version will resolve the vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for trigger.dev.
