{"items":[{"id":"NVI-00013121","kind":"vulnerability","title":"Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pqxw-g93w-hj9x","CVE-2026-114087"],"plain_summary":"GitHub lists this reviewed advisory for trigger.dev. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-68aa5dfda78a9429bc43610d9c784cf1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.5.6 for trigger.dev. Confirm the publisher’s latest guidance.","source_ids":["sr-eae07b145fbd8698aa6408d71f34c2aa"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-68aa5dfda78a9429bc43610d9c784cf1","url":"https://github.com/advisories/GHSA-pqxw-g93w-hj9x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pqxw-g93w-hj9x","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:40:00.567Z"},{"id":"sr-eae07b145fbd8698aa6408d71f34c2aa","url":"https://github.com/advisories/GHSA-pqxw-g93w-hj9x","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-pqxw-g93w-hj9x","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-08T01:48:11.515Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-68aa5dfda78a9429bc43610d9c784cf1"],"technology":"trigger.dev","known_exclusions":[],"conditions_summary":"## Summary\n\nSelf-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from `hosting/docker/.env.example` are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise.\n\n## Vulnerability Details\n\nThe `hosting/docker/.env.example` file contains hardcoded cryptographic secrets:\n\n```\nSESSION_SECRET=2818143646516f6fffd707b36f334bbb\nMAGIC_LINK_SECRET=44da78b7bbb0dfe709cf38931d25dcdd\nENCRYPTION_KEY=f686147ab967943ebbe9ed3b496e465a\nMANAGED_WORKER_SECRET=447c29678f9eaf289e9c4b70d3dd8a7f\n```\n\nThe `MAGIC_LINK_SECRET` is used by `remix-auth-email-link@2.0.2` to create authentication tokens via CryptoJS AES encryption. An attacker who knows this secret can forge valid magic links that authenticate as any email address without email delivery. The `validateSessionMagicLink` option defaults to `false` in the library (never overridden by trigger.dev), so no session-side validation occurs. User accounts are auto-created when `WHITELISTED_EMAILS` is not set (the default for self-hosted).\n\n## Steps to Reproduce\n\n### Setup\n```bash\ncd hosting/docker && cp .env.example .env\ncd webapp && docker compose up","public_affected_ranges":["<= 4.5.5"]},{"certainty":"source_listed","source_ids":["sr-eae07b145fbd8698aa6408d71f34c2aa"],"technology":"trigger.dev","known_exclusions":[],"conditions_summary":"## Summary\n\nSelf-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from `hosting/docker/.env.example` are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise.\n\n## Vulnerability Details\n\nThe `hosting/docker/.env.example` file contains hardcoded cryptographic secrets:\n\n```\nSESSION_SECRET=2818143646516f6fffd707b36f334bbb\nMAGIC_LINK_SECRET=44da78b7bbb0dfe709cf38931d25dcdd\nENCRYPTION_KEY=f686147ab967943ebbe9ed3b496e465a\nMANAGED_WORKER_SECRET=447c29678f9eaf289e9c4b70d3dd8a7f\n```\n\nThe `MAGIC_LINK_SECRET` is used by `remix-auth-email-link@2.0.2` to create authentication tokens via CryptoJS AES encryption. An attacker who knows this secret can forge valid magic links that authenticate as any email address without email delivery. The `validateSessionMagicLink` option defaults to `false` in the library (never overridden by trigger.dev), so no session-side validation occurs. User accounts are auto-created when `WHITELISTED_EMAILS` is not set (the default for self-hosted).\n\n## Steps to Reproduce\n\n### Setup\n```bash\ncd hosting/docker && cp .env.example .env\ncd webapp && docker compose up","public_affected_ranges":["SEMVER: introduced 0; fixed 4.5.6"]}],"null_published_at":"2026-11-08T08:10:35.856Z","source_updated_at":"2026-10-02T22:42:08.000Z","source_disclosed_at":"2026-10-02T22:39:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T01:40:00.567Z"},{"id":"NVI-00013121","kind":"vulnerability","title":"Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pqxw-g93w-hj9x"],"plain_summary":"GitHub lists this reviewed advisory for trigger.dev. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-68aa5dfda78a9429bc43610d9c784cf1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-68aa5dfda78a9429bc43610d9c784cf1","url":"https://github.com/advisories/GHSA-pqxw-g93w-hj9x","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pqxw-g93w-hj9x","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:40:00.567Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-68aa5dfda78a9429bc43610d9c784cf1"],"technology":"trigger.dev","known_exclusions":[],"conditions_summary":"## Summary\n\nSelf-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from `hosting/docker/.env.example` are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise.\n\n## Vulnerability Details\n\nThe `hosting/docker/.env.example` file contains hardcoded cryptographic secrets:\n\n```\nSESSION_SECRET=2818143646516f6fffd707b36f334bbb\nMAGIC_LINK_SECRET=44da78b7bbb0dfe709cf38931d25dcdd\nENCRYPTION_KEY=f686147ab967943ebbe9ed3b496e465a\nMANAGED_WORKER_SECRET=447c29678f9eaf289e9c4b70d3dd8a7f\n```\n\nThe `MAGIC_LINK_SECRET` is used by `remix-auth-email-link@2.0.2` to create authentication tokens via CryptoJS AES encryption. An attacker who knows this secret can forge valid magic links that authenticate as any email address without email delivery. The `validateSessionMagicLink` option defaults to `false` in the library (never overridden by trigger.dev), so no session-side validation occurs. User accounts are auto-created when `WHITELISTED_EMAILS` is not set (the default for self-hosted).\n\n## Steps to Reproduce\n\n### Setup\n```bash\ncd hosting/docker && cp .env.example .env\ncd webapp && docker compose up","public_affected_ranges":["<= 4.5.5"]}],"null_published_at":"2026-11-01T07:29:12.923Z","source_updated_at":"2026-10-02T22:42:08.000Z","source_disclosed_at":"2026-10-02T22:39:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:40:00.567Z"}],"next_cursor":null,"snapshot_revision":"42594"}