{"id":"EUVD-2026-106884","enisaUuid":"4308c7e2-e1fd-3443-9db8-1d5957ee61af","description":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations\u0027 analytics data.","datePublished":"Oct 21, 2026, 12:36:49 AM","dateUpdated":"Oct 21, 2026, 12:36:49 AM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9q4r-4842-93vw\nhttps://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-tenant-sql-injection-via-tsql-window-function-name\n","aliases":"CVE-2026-114081\nGHSA-vmhj-4cqp-m5cj\n","assigner":"VulnCheck","epss":0.28,"enisaIdProduct":[{"id":"59be3ee9-dff1-3754-929b-406f06b9808d","product":{"name":"trigger.dev","vendor":{"name":"triggerdotdev"}},"product_version":"0 \u003c4.5.6"}],"enisaIdVendor":[{"id":"e62c604e-5a85-3bba-a037-76719833c540","vendor":{"name":"triggerdotdev"}}],"enisaIdVulnerability":[{"id":"3208bf14-f0ff-3bc5-959b-2b4bd7a6c3b4","vulnerability":{"id":"CVE-2026-114081","description":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations\u0027 analytics data.","datePublished":"Oct 21, 2026, 12:36:49 AM","dateUpdated":"Oct 21, 2026, 12:36:49 AM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9q4r-4842-93vw\nhttps://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-tenant-sql-injection-via-tsql-window-function-name\n","enisa_id":"EUVD-2026-106884\n","assigner":"VulnCheck","epss":0.28,"dataProcessed":"Oct 27, 2026, 7:14:58 AM","vulnerabilityProduct":[{"id":"bc3db3d0-5229-3625-b263-97feeaa1091c","product":{"name":"trigger.dev","vendor":{"name":"triggerdotdev"}},"product_version":"0 \u003c4.5.6"}],"vulnerabilityVendor":[{"id":"0346d18f-1b23-3792-892d-3366f913516d","vendor":{"name":"triggerdotdev"}}]}},{"id":"fbce7ca5-7d6b-3d9e-85d1-6bc686a11fb2","vulnerability":{"id":"GHSA-vmhj-4cqp-m5cj","description":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations\u0027 analytics data.","datePublished":"Oct 21, 2026, 3:32:22 AM","dateUpdated":"Oct 21, 2026, 3:32:22 AM","baseScore":0.0,"references":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9q4r-4842-93vw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114081\nhttps://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-tenant-sql-injection-via-tsql-window-function-name\n","enisa_id":"EUVD-2026-106884\n","aliases":"CVE-2026-114081\nGHSA-vmhj-4cqp-m5cj\n","epss":0.0,"dataProcessed":"Oct 27, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}