triggerdotdev Trigger.dev up to 4.5.0-rc.4 Path Normalization objectStoreClient.server.ts Aws4FetchClient.buildUrl/Aws4FetchClient.presign params input validation

Summaryinfo

A vulnerability was found in triggerdotdev Trigger.dev up to 4.5.0-rc.4. It has been declared as critical. Affected by this vulnerability is the function Aws4FetchClient.buildUrl/Aws4FetchClient.presign of the file apps/webapp/app/v3/objectStoreClient.server.ts of the component Path Normalization. Such manipulation of the argument params leads to input validation. This vulnerability is documented as CVE-2026-73658. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in triggerdotdev Trigger.dev up to 4.5.0-rc.4. It has been rated as critical. Affected by this issue is the function Aws4FetchClient.buildUrl/Aws4FetchClient.presign of the file apps/webapp/app/v3/objectStoreClient.server.ts of the component Path Normalization. The manipulation of the argument params with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResource: async () => 1 without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads. This issue is fixed in version 4.5.0-rc.5.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-73658 since 08/13/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

Upgrading to version 4.5.0-rc.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• triggerdotdev

Name

• Trigger.dev

Version

• 4.5.0-rc.0
• 4.5.0-rc.1
• 4.5.0-rc.2
• 4.5.0-rc.3
• 4.5.0-rc.4

Website

• Product: https://github.com/triggerdotdev/trigger.dev/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion