Trigger Dev Before 4.5.6 Cross Tenant Sql Injection Via Tsql Window Function Name

Back www.vulncheck.com

Trigger Dev Before 4.5.6 Cross Tenant Sql Injection Via Tsql Window Function Name

www.vulncheck.com • October 22, 2026

Share: View original

Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

trigger.dev >= 0, = 0, < 4.5.6

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

GitHub Security Advisory (GHSA-9q4r-4842-93vw)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Trigger.dev Versions Prior to 4.5.6 and 4.6.2 Trigger.dev has multiple vulnerabilities affecting versions before 4.5.6 and 4.6.2, including Cross-Tenant SQL Injection, Cross-Organization Schedule Deletion, and Authentication Bypass via Hardcoded Default Secrets. These vulnerabilities are categorized under CWE-89 and CWE-639, posing risks of unauthorized access and data manipulation. The vulnerabilities could allow attackers to exploit SQL injection flaws and bypass authentication, potentially leading to significant data breaches. Current advisories recommend immediate action to mitigate these risks. No has been confirmed at this time, but organizations are urged to prioritize patching. The vulnerabilities were disclosed on October 22, 2026, with specific GitHub Security Advisories linked for further details. 45

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-89 - SQL Injection

Domains (1)

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application