EUVD-2026-352520

fkie_cve-2026-73654

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service. This issue is fixed in version 4.5.6.

GHSA-p28v-f755-9qrg — Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

Affected: npm: @trigger.dev/core

## Summary

The run-metadata update endpoint `PUT /api/v1/runs/:runId/metadata` applies client-supplied "operations" by passing the **attacker-controlled `operation.key`** straight into `new JSONHeroPath(operation.key).set(newMetadata, value)` (`packages/core/src/v3/runMetadata/operations.ts:22-23`), with **no prototype-pollution guard** (`@jsonhero/path@^1.0.21` does not reject `__proto__`/`constructor`/`prototype`).

A request with `key: "$.__proto__.polluted"` sets **`Object.prototype.polluted`** in the webapp process. Because every plain object then inherits that property, it corrupts unrelated code **process-wide and across tenants** — including Prisma query building and the Prometheus metrics client — causing query failures, **broken authentication for other tenants' workers**, and an `uncaughtException` (denial of service). Only a normal, low-privilege environment API key is required (one request).

## Severity

A single request from any holder of a normal environment API key contaminates `Object.prototype` in the shared webapp process, breaking other tenants' workers (scope change) and degrading/ crashing the process (high availability impact). Prototype pollution is also a primitive for further gadget chains (integrity/confidentiality).

## Affected versions

- **Introduced** in commit `34f8bd588` ("Add ability to update parent and root run metadata from children", PR #1563, 2025-01-08) — the `JSONHeroPath(operation.key).set()` sink is present from the first com…

Most recent entries from all

EUVD-2026-352520

fkie_cve-2026-73654

GHSA-p28v-f755-9qrg — Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS