CVE-2026-73654 in trigger.dev
Summary
by MITRE • 08/13/2026
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service. This issue is fixed in version 4.5.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability exists within Trigger.dev's platform where the PUT /api/v1/runs/:runId/metadata endpoint fails to properly validate attacker-controlled input values during metadata operations. Specifically, the system accepts operation.key values directly from API requests and passes them unfiltered to the JSONHeroPath constructor in the core package. This design flaw allows malicious actors with normal environment API keys to manipulate object prototypes through crafted payload data.
The technical implementation of this vulnerability stems from insufficient input validation within packages/core/src/v3/runMetadata/operations.ts where the system creates new JSONHeroPath(operation.key) objects without rejecting potentially dangerous path segments that could modify prototype properties. When these operations are executed against Object.prototype, they can alter fundamental object behaviors across the entire webapp process. The flaw is classified as a prototype pollution vulnerability which falls under CWE-471 and aligns with ATT&CK technique T1589.002 for exploitation of prototype pollution in node.js applications.
The operational impact of this vulnerability extends far beyond simple data corruption, creating cascading failures throughout the platform's architecture. Successful exploitation allows attackers to pollute Object.prototype which then affects all subsequent Prisma database queries and Prometheus metrics labeling operations. This corruption can lead to authentication breakdowns between different tenant environments, as worker processes lose their ability to properly authenticate requests from other tenants. The most severe consequence is the potential for process-wide denial of service attacks that can compromise the entire shared webapp instance, affecting all users on the platform simultaneously.
Mitigation strategies should focus on implementing comprehensive input validation at multiple layers of the application architecture. All user-supplied operation.key values must be filtered to reject any path segments containing prototype-related keywords such as _proto_, constructor, or prototype. The system should implement a whitelist approach for valid JSON path operations and sanitize all inputs before passing them to the JSONHeroPath constructor. Additionally, the platform should consider implementing process isolation between tenant environments and establishing more robust monitoring for anomalous prototype modifications. The fix in version 4.5.6 demonstrates that proper validation of user inputs combined with defensive programming practices can effectively prevent this class of vulnerability from being exploited across the platform's distributed architecture.