Trigger.dev CLI before version 4.5.9 serializes environment variables without redaction in debug deployment logs, causing resolved secret values such as database connection strings and service credentials to be exposed. This information disclosure could allow an attacker to obtain critical operational secrets used by the application.

The vulnerability affects the Trigger.dev command‑line interface provided by triggerdotdev, specifically any installation prior to version 4.5.9. Users of older CLI releases are at risk if they rely on debug logging, CI transcripts, or support bundles that capture deployment logs.

The CVSS score of 6.8 classifies the issue as a medium‑severity information leak. However, the EPSS score is reported as less than 1 %, indicating a very low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to obtain terminal transcripts, CI debug logs, or support bundles that contain the unredacted logs to exploit this flaw, so the actual threat level depends on the logging practices and access controls in place.