{"schema":"threatline.record/2","record":{"id":"GHSA-59h8-w5q6-mfmp","aliases":["CVE-2026-114086","GHSA-59h8-w5q6-mfmp"],"summary":"Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId","details":"## Summary\n\nThe POST handler for `/realtime/v1/streams/:runId/:streamId` has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream.\n\n## Vulnerability Details\n\n**File:** `apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts`\n\nThe `action` handler (line 17) has no auth wrapper. The code comment says: \"Plain action for backwards compatibility with older clients that don't send auth headers.\"\n\nThe run lookup at line 29 uses `where: { friendlyId: runId }` with NO environment scoping (`runtimeEnvironmentId` is not checked), so production runs are accessible.\n\nRun friendlyIds follow predictable patterns (e.g., `run_1234abcd`).\n\n## Steps to Reproduce\n\n```bash\n# No authentication required\ncurl -X POST \"http://localhost:8030/realtime/v1/streams/run_KNOWN_ID/stream_1\"   -H \"Content-Type: application/json\"   -d '{\"injected\": \"data\"}'\n```\n\n## Impact\n\nUnauthenticated data injection into any run realtime stream. Cross-environment access (no scoping).","categories":["Frameworks"],"product":"trigger.dev","vendor":"","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-59h8-w5q6-mfmp","source_modified_at":"2026-10-02T22:39:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"trigger.dev"},"range":"<= 4.5.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-59h8-w5q6-mfmp","source_modified_at":"2026-10-21T10:57:25.058188264Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"trigger.dev","ecosystem":"npm","purl":"pkg:npm/trigger.dev"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.5"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-59h8-w5q6-mfmp","source_modified_at":"2026-10-02T22:39:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"trigger.dev"},"version":"4.5.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-59h8-w5q6-mfmp","source_modified_at":"2026-10-21T10:57:25.058188264Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"trigger.dev","ecosystem":"npm","purl":"pkg:npm/trigger.dev"},"version":"4.5.5"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-02T22:39:57Z","modified_at":"2026-10-21T10:57:25.058188264Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-59h8-w5q6-mfmp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-02T22:39:57Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-59h8-w5q6-mfmp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-21T10:57:25.058188264Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-59h8-w5q6-mfmp","source":"GitHub Advisory Database"},{"url":"https://github.com/triggerdotdev/trigger.dev/pull/4250","source":"GitHub Advisory Database"},{"url":"https://github.com/triggerdotdev/trigger.dev/commit/73d966ad226548b5f96fb5b4fc6fa607a3b7b8f8","source":"GitHub Advisory Database"},{"url":"https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.5","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-59h8-w5q6-mfmp","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T10:57:25.058188264Z","content_hash":"a197f4115265f041ea3f4b6d956836d01026419a5b8e92e7624f84bee190ec5c"}}