GHSA-59h8-w5q6-mfmp: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream.
References
- github.com/advisories/GHSA-59h8-w5q6-mfmp
- github.com/triggerdotdev/trigger.dev/commit/73d966ad226548b5f96fb5b4fc6fa607a3b7b8f8
- github.com/triggerdotdev/trigger.dev/pull/4250
- github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.5
- github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-59h8-w5q6-mfmp
Code Behaviors & Features
Detect and mitigate GHSA-59h8-w5q6-mfmp with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →