{"action":"Upgrade trigger.dev to 4.5.2 or later.","affected":[{"fixed":"4.5.2","introduced":"0"}],"component":"trigger.dev","cve_ids":["CVE-2026-85650"],"ecosystem":"npm","epss":0.00348,"exploited":false,"fixed_versions":["4.5.2"],"ghsa_id":"GHSA-xxv7-2vv3-h682","id":"tcs_01M5KGK8W9DJ5NMK10PZYQTA60","modified_at":"2026-10-02T19:45:03.509666402Z","published_at":"2026-10-02T19:31:33Z","references":["https://osv.dev/vulnerability/GHSA-xxv7-2vv3-h682","https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682","https://github.com/triggerdotdev/trigger.dev/pull/4199","https://github.com/triggerdotdev/trigger.dev","https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-xxv7-2vv3-h682","url":"https://osv.dev/vulnerability/GHSA-xxv7-2vv3-h682"}],"summary":"Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL"}