Trigger.dev Trigger CLI debug logs expose environment secrets

Severity: medium · CVSS 5.5 · Published 2026-10-02

Trigger.dev's command-line deployment tool logs sensitive environment variables (database credentials, service secrets) in plaintext when running in debug mode, even during dry-run deployments that don't actually execute. An attacker with access to developer terminal transcripts, CI logs, or support bundles can extract these secrets to compromise backend services and data.

Technologies: trigger.dev (npm). Vendors: npm, Trigger.dev.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 5.5, published 2 October 2026.
Which products and versions are affected?
trigger.dev (npm) <= 4.5.8; Trigger.dev Trigger CLI <= 4.5.8.
Is there a fix for This vulnerability?
Yes: fixed in 4.5.9. Until then: Avoid using `--log-level debug` with the `trigger.dev deploy` command in CI pipelines or shared environments; use standard log level instead. Restrict access to CI job logs, terminal session history, and support bundles to authorized personnel only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a software library.
Am I affected?
Check whether you run trigger.dev (npm) or Trigger.dev Trigger CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.5.9

Avoid using `--log-level debug` with the `trigger.dev deploy` command in CI pipelines or shared environments; use standard log level instead. Restrict access to CI job logs, terminal session history, and support bundles to authorized personnel only.

Technical details

The Trigger CLI tool logs the complete `buildWorker` options object to debug output, which contains an `envVars` property with unredacted secret values. This occurs during the `deploy --env staging --dry-run --log-level debug` command flow. The vulnerability requires local access to logs (terminal transcript, CI system, captured output, or support bundle) and user interaction to trigger the deployment command; no authentication bypass or network attack is required. An attacker can enumerate and exfiltrate all configured environment secrets.

Affected products

  • Trigger.dev Trigger CLI <= 4.5.8

Timeline

  • 2026-07-31: disclosed
  • 2026-10-02: advisory
  • 2026-10-02: patched: version 4.5.9 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.