CVE-2026-73654

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service. This issue is fixed in version 4.5.6.

• CWE-1321

• https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
• https://github.com/triggerdotdev/trigger.dev/pull/4316
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg

Published

Aug 13, 2026

Last Modified

Aug 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73649Velocity.js is a JavaScript implementation of the Apache Vel…9.8
• CVE-2026-7365IBM Operations Analytics - Log Analysis  and IBM SmartCloud …7.8
• CVE-2026-73650SVGO, short for SVG Optimizer, is a Node.js library and comm…8.2
• CVE-2026-73651TypeORM is a TypeScript and JavaScript ORM for Node.js that …5.7
• CVE-2026-73652vantage6 is an open-source infrastructure for privacy preser…7.1
• CVE-2026-73653Vitest is a testing framework powered by Vite. Prior to vers…9.4
• CVE-2026-73655Trigger.dev is a platform for building and deploying fully m…7.4
• CVE-2026-73656Trigger.dev is a platform for building and deploying fully m…9.9
• CVE-2026-73657Trigger.dev is a platform for building and deploying fully m…4.2
• CVE-2026-73658Trigger.dev is a platform for building and deploying fully m…8.2
• CVE-2026-73659Trigger.dev is the open-source platform for building AI work…8.1
• CVE-2026-7366IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM Data…4.2