Élevée
7.7
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler,...
CVE-2026-114081
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com