{"action":"Upgrade trigger.dev to 4.5.2 or later.","affected":[{"fixed":"4.5.2","introduced":"0"}],"component":"trigger.dev","cve_ids":["CVE-2026-114076"],"ecosystem":"npm","exploited":false,"fixed_versions":["4.5.2"],"ghsa_id":"GHSA-q567-cr4x-96w4","id":"tcs_01M5JK9QF9NFMC924E8PYKYP3Q","modified_at":"2026-10-21T10:57:22.483043237Z","published_at":"2026-10-02T22:35:31Z","references":["https://osv.dev/vulnerability/GHSA-q567-cr4x-96w4","https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-q567-cr4x-96w4","https://github.com/triggerdotdev/trigger.dev/pull/4199","https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254","https://github.com/triggerdotdev/trigger.dev","https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-q567-cr4x-96w4","url":"https://osv.dev/vulnerability/GHSA-q567-cr4x-96w4"}],"summary":"Trigger.dev: Blind SSRF via alert-channel webhook"}