GHSA-fj2x-mqqp-3v2w

Source

https://github.com/advisories/GHSA-fj2x-mqqp-3v2w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fj2x-mqqp-3v2w/GHSA-fj2x-mqqp-3v2w.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-fj2x-mqqp-3v2w

Downstream

MINI-96p2-px88-6f4p

Published

2026-10-02T22:45:12Z

Modified

2026-10-02T23:00:21Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Details

Affected version: trigger.dev 4.5.3 (4.5.6 was advertised by the CLI but was not tested).

A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values for every resolved staging variable, including database connection strings and service credentials. The non-debug environment listing correctly hides values, so users can reasonably expect deployment logs not to print secrets.

Impact: anyone with access to a developer terminal transcript, CI debug log, captured agent/tool output, or support bundle can recover deployment secrets even though no deployment occurs.

Reproduction:

Configure a Trigger.dev project with a secret environment variable.
Run the command above with an authenticated profile.
Inspect the Starting buildWorker debug record.
options.envVars contains the plaintext value.

No real credential is included in this report. The observed customer credentials are being rotated separately.

Suggested remediation: never serialize envVars values in debug output; log names only or replace every value with a fixed marker. Add regression coverage for deploy, dry-run, and debug logging, and review adjacent debug records for resolved secrets.

Database specific

{
    "cwe_ids": [
        "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T22:45:12Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / trigger.dev

Package

Name: trigger.dev; View open source insights on deps.dev
Purl: pkg:npm/trigger.dev

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.5.9

Database specific

last_known_affected_version_range

"<= 4.5.8"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fj2x-mqqp-3v2w/GHSA-fj2x-mqqp-3v2w.json"