GHSA-qxpp-qjg8-x4jv: Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)

The dashboard replay action authorizes the source run (it must belong to the caller’s org), but the target environment for the replayed run is taken verbatim from the request body and is never checked for org or project membership. The environment lookup used by the replay path filters by id only. As a result, an authenticated user can replay one of their own runs into another organization’s or project’s environment, creating a task run there that consumes the victim tenant’s queue and compute and pollutes their run history.