Trigger.dev CLI EUVD-2026-107024

Exploitation requires two things to coincide: (1) a Trigger.dev project configured with secret environment variables, and someone running the CLI deploy command with debug logging enabled (e.g. trigger.dev deploy --log-level debug, which also triggers on --dry-run with an authenticated profile); and (2) attacker access to the resulting output - a developer terminal transcript, CI debug log, captured agent/tool output, or a support bundle. It is NOT a default-configuration remote exposure: normal (non-debug) environment listings correctly redact values, so debug log level is the enabling non-default condition. The practical limiting factors are the need for debug-level logging to have been used and for the output to be retained or accessible to the attacker; versions at or above 4.5.9 are not affected.

This is a moderate-severity information-disclosure issue (CWE-532) with a realistic but constrained risk profile. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) scores 6.8 and correctly characterizes the flaw: local attack vector (the secrets land in log/transcript output rather than being remotely reachable), low complexity, no privileges needed by the party who ultimately reads the log, but passive user interaction (UI:P) because a developer must run the deploy command with debug logging before any exposure occurs. Confidentiality impact is High (full plaintext secrets) with no integrity or availability impact, which matches the description. No EPSS score, KEV listing, or SSVC decision was supplied in the input, so exploitation-probability and automatability signals are unavailable and cannot be used to up- or down-rank this. The vulnerability is confirmed and patched by the vendor (GHSA-fj2x-mqqp-3v2w, fixed in 4.5.9) and reported by VulnCheck, so the technical facts are well-substantiated. The realistic danger is not mass remote exploitation but downstream secret leakage: database connection strings and service credentials written into CI debug logs, support bundles, or captured agent/tool output that may be retained, shared, or indexed far more widely than the developer intended. Priority should be driven by whether debug-level deploy logging has been used in shared CI or support contexts, not by the raw CVSS number alone.

A developer or CI pipeline runs trigger.dev deploy --env staging --dry-run --log-level debug, which serializes the build-worker options object and prints the Starting buildWorker record containing every resolved envVars value in plaintext. An attacker (or over-privileged insider) who later obtains that CI debug log, terminal transcript, or support bundle reads the database connection strings and service credentials directly - no deployment or code execution is required. Public reproduction steps exist in the GHSA advisory, lowering the effort to trigger the condition.