# Trigger.dev Trigger CLI debug logs expose environment secrets

Source: https://junglewise.ai/threats/trigger-dev-trigger-cli-debug-deployment-logs-expose-resolved-fcb585ad  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-02  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.5 · Published 2026-10-02

Trigger.dev's command-line deployment tool logs sensitive environment variables (database credentials, service secrets) in plaintext when running in debug mode, even during dry-run deployments that don't actually execute. An attacker with access to developer terminal transcripts, CI logs, or support bundles can extract these secrets to compromise backend services and data.

Technologies: [trigger.dev (npm)](https://junglewise.ai/threats/technologies/npm-trigger-dev). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Trigger.dev](https://junglewise.ai/threats/vendors/trigger-dev).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.5, published 2 October 2026.

**Which products and versions are affected?** trigger.dev (npm) <= 4.5.8; Trigger.dev Trigger CLI <= 4.5.8.

**Is there a fix for This vulnerability?** Yes: fixed in 4.5.9. Until then: Avoid using `--log-level debug` with the `trigger.dev deploy` command in CI pipelines or shared environments; use standard log level instead. Restrict access to CI job logs, terminal session history, and support bundles to authorized personnel only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run trigger.dev (npm) or Trigger.dev Trigger CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.5.9

Avoid using `--log-level debug` with the `trigger.dev deploy` command in CI pipelines or shared environments; use standard log level instead. Restrict access to CI job logs, terminal session history, and support bundles to authorized personnel only.

## Technical details

The Trigger CLI tool logs the complete `buildWorker` options object to debug output, which contains an `envVars` property with unredacted secret values. This occurs during the `deploy --env staging --dry-run --log-level debug` command flow. The vulnerability requires local access to logs (terminal transcript, CI system, captured output, or support bundle) and user interaction to trigger the deployment command; no authentication bypass or network attack is required. An attacker can enumerate and exfiltrate all configured environment secrets.

## Affected products

- Trigger.dev Trigger CLI <= 4.5.8

## Timeline

- 2026-07-31: disclosed
- 2026-10-02: advisory
- 2026-10-02: patched: version 4.5.9 released

## References

- [https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fj2x-mqqp-3v2w](https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fj2x-mqqp-3v2w)

## Related threats

- [Trigger.dev cross-environment deployment cancellation](https://junglewise.ai/threats/trigger-dev-cross-environment-deployment-cancel-2032bf7e)
- [Trigger.dev cross-tenant SQL injection in TSQL query compiler](https://junglewise.ai/threats/trigger-dev-cross-tenant-sql-injection-in-the-tsql-query-compiler-post-98af5ddc)
- [Trigger.dev unauthenticated data injection in realtime stream API](https://junglewise.ai/threats/trigger-dev-unauthenticated-realtime-stream-data-injection-via-run-b0ac295b)
- [trigger.dev Self-Hosted unauthenticated magic link forgery via hardcoded secrets](https://junglewise.ai/threats/trigger-dev-self-hosted-deployment-default-secrets-allow-fb585509)
- [Trigger.dev V1 coordinator default-secret unauthenticated access](https://junglewise.ai/threats/trigger-dev-v1-coordinator-default-secret-unauth-socket-io-232d6390)