{"apiVersion":"1.0","identifier":"CVE-2026-73654","description":"Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants- worker authentication, and causing a process-wide denial of service. This issue is fixed in version 4.5.6.","publishedAt":"2026-08-13T20:17:30","lastModifiedAt":"2026-08-14T17:20:35","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73654","cvssScore":8.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","epssProbability":0.00334,"riskScore":0.88,"affectedProduct":"Trigger.dev","affectedVersions":">=3.3.8,<4.5.6","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73654","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73654","en":"https://www.redsauce.net/en/cves/CVE-2026-73654","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73654","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73654","de":"https://www.redsauce.net/de/cves/CVE-2026-73654","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73654","el":"https://www.redsauce.net/el/cves/CVE-2026-73654"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73654"}}