{"action":"Upgrade trigger.dev to 4.5.2 or later.","affected":[{"fixed":"4.5.2","introduced":"0"}],"component":"trigger.dev","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["4.5.2"],"ghsa_id":"GHSA-pp95-gc86-jq6q","id":"tcs_01M5JKSQ0XFD3D1R5X1VWQYS3T","modified_at":"2026-10-21T10:58:05.446872453Z","published_at":"2026-10-02T22:35:24Z","references":["https://osv.dev/vulnerability/GHSA-pp95-gc86-jq6q","https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q","https://github.com/triggerdotdev/trigger.dev/pull/4199","https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254","https://github.com/triggerdotdev/trigger.dev","https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-pp95-gc86-jq6q","url":"https://osv.dev/vulnerability/GHSA-pp95-gc86-jq6q"}],"summary":"Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)"}