ETK-2026-393Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-393",
  "cve_id": null,
  "display_id": "ETK-2026-393",
  "ghsa_id": "GHSA-9q4r-4842-93vw",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "SQL injection in trigger.dev TSQL query compiler",
  "summary": "npm package trigger.dev releases before 4.5.6 contain an SQL injection flaw in the TSQL query compiler. An authenticated customer able to use the query API could bypass tenant query restrictions and read analytics data from other tenants.",
  "mitigation": "Upgrade trigger.dev to version 4.5.6 or later. Until the update is deployed, restrict access to the query API and rotate or limit credentials granted to untrusted users.",
  "vendor": "npm",
  "product": "npm:trigger.dev",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 4.5.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "4.5.6"
      ],
      "package_name": "trigger.dev",
      "purl": "pkg:npm/trigger.dev"
    }
  ],
  "cwes": null,
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.87371033333333,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-02T22:42:20+00:00",
      "days": -18.959574295266204,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T21:44:07.243619+00:00",
      "url": "https://github.com/advisories/GHSA-9q4r-4842-93vw"
    },
    "trigger_signal": {
      "at": "2026-10-02T22:42:20+00:00",
      "days": -18.959574295266204,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T21:44:07.243619+00:00",
      "url": "https://github.com/advisories/GHSA-9q4r-4842-93vw"
    }
  }
}