CVE-2026-73654

## Summary The run-metadata update endpoint `PUT /api/v1/runs/:runId/metadata` applies client-supplied "operations" by passing the **attacker-controlled `operation.key`** straight into `new JSONHeroPath(operation.key).set(newMetadata, value)` (`packages/core/src/v3/runMetadata/operations.ts:22-23`), with **no prototype-pollution guard** (`@jsonhero/path@^1.0.21` does not reject `__proto__`/`constructor`/`prototype`). A request with `key: "$.__proto__.polluted"` sets **`Object.prototype.polluted`** in the webapp process. Because every plain object then inherits that property, it corrupts unrelated code **process-wide and across tenants** — including Prisma query building and the Prometheus metrics client — causing query failures, **broken authentication for other tenants' workers**, and an `uncaughtException` (denial of service). Only a normal, low-privilege environment API key is required (one request). ## Severity A single request from any holder of a normal environment API key contaminates `Object.prototype` in the shared webapp process, breaking other tenants' workers (scope change) and degrading/ crashing the process (high availability impact). Prototype pollution is also a primitive for further gadget chains (integrity/confidentiality). ## Affected versions - **Introduced** in commit `34f8bd588` ("Add ability to update parent and root run metadata from children", PR #1563, 2025-01-08) — the `JSONHeroPath(operation.key).set()` sink is present from the first commit of `operations.ts`. SDK was at `3.3.8` at that time. - **Still present at HEAD** (SDK `4.5.0-rc.7`); `operations.ts` unchanged since 2025-05, and `@jsonhero/path` is pinned at `^1.0.21` (no proto-guard) throughout. - **Affected range:** `>= v3.3.8` (metadata operations API) through `v4-beta` / current v4.x — **fixed: 4.5.6**. ## Root cause `packages/core/src/v3/runMetadata/operations.ts` — `applyMetadataOperations()` builds a path from the **untrusted** `operation.key` and writes to it,