HIGHCVSS 8.5Vulnerability
CVE-2026-73654
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service. This issue is fixed in version 4.5.6.
Properties
- summary
- Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
- severity
- HIGH
- epss_score
- 0.0062
- cvss_severity
- HIGH
- cvss_score
- 8.5
- retrieved_at
- 2026-09-28T08:29:24+00:00
- ghsa_published
- 2026-08-13T20:54:11Z
- source_url
- https://github.com/advisories/GHSA-p28v-f755-9qrg
- ghsa_updated
- 2026-08-13T20:54:13Z
- ghsa_id
- GHSA-p28v-f755-9qrg
- score
- 8.5
- last_source
- FIRST EPSS
- cve_id
- CVE-2026-73654
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
- published_at
- 2026-08-13T20:17:30.007
- last_modified
- 2026-09-18T20:09:01.757
- epss_percentile
- 0.47613
Related Entities (6)
DESCRIBED_BY (1)
→[Source]NVD
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]npm/@trigger.dev/core
AFFECTS (1)
→[Software]npm/@trigger.dev/core
HAS_WEAKNESS (1)
→[Weakness]Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph