{"items":[{"id":"NVI-00013181","kind":"vulnerability","title":"Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fj2x-mqqp-3v2w"],"plain_summary":"GitHub lists this reviewed advisory for trigger.dev. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-86c8c88312c87ba3e4612712f44fc5e0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-02T22:45:13.000Z","value":"5.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-86c8c88312c87ba3e4612712f44fc5e0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-86c8c88312c87ba3e4612712f44fc5e0","url":"https://github.com/advisories/GHSA-fj2x-mqqp-3v2w","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fj2x-mqqp-3v2w","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:40:00.567Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-86c8c88312c87ba3e4612712f44fc5e0"],"technology":"trigger.dev","known_exclusions":[],"conditions_summary":"Affected version: trigger.dev 4.5.3 (4.5.6 was advertised by the CLI but was not tested).\n\nA staging dry-run executed with `trigger.dev deploy --env staging --dry-run --log-level debug`. The debug output logged the complete build-worker options object. Its `envVars` property contained unredacted values for every resolved staging variable, including database connection strings and service credentials. The non-debug environment listing correctly hides values, so users can reasonably expect deployment logs not to print secrets.\n\nImpact: anyone with access to a developer terminal transcript, CI debug log, captured agent/tool output, or support bundle can recover deployment secrets even though no deployment occurs.\n\nReproduction:\n1. Configure a Trigger.dev project with a secret environment variable.\n2. Run the command above with an authenticated profile.\n3. Inspect the `Starting buildWorker` debug record.\n4. `options.envVars` contains the plaintext value.\n\nNo real credential is included in this report. The observed customer credentials are being rotated separately.\n\nSuggested remediation: never serialize `envVars` values in debug output; log names only or replace every value with a fixe","public_affected_ranges":["<= 4.5.8"]}],"null_published_at":"2026-11-01T07:29:12.928Z","source_updated_at":"2026-10-02T22:45:13.000Z","source_disclosed_at":"2026-10-02T22:45:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:40:00.567Z"}],"next_cursor":null,"snapshot_revision":"42594"}