CVE-2026-73654 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments should assess exposure and prioritize upgrading to version 4.5.6 or later. Additionally, security teams and vulnerability management teams should review the current version and assess exposure, as versions from 3.3.8 to 4.5.5 are affected. Operators of Trigger.dev should also review their systems and implement additional security measures to prevent similar vulnerabilities.

Why it matters

CVE-2026-73654 is a high-severity vulnerability in Trigger.dev that allows for Object.prototype pollution, leading to potential security issues. Defenders should prioritize upgrading to version 4.5.6 or later and assess exposure.

• Potential corruption of Prisma queries and Prometheus labels
• Breakage of other tenants' worker authentication
• Process-wide denial of service

Technical summary

The vulnerability is caused by the PUT /api/v1/runs/:runId/metadata endpoint passing attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) without rejecting dangerous constructor and prototype path segments. This allows for Object.prototype pollution, leading to potential security issues. The issue affects versions from 3.3.8 to 4.5.5 and is fixed in version 4.5.6. Defenders should prioritize upgrading to version 4.5.6 or later to mitigate this vulnerability. They should also review their current version and assess exposure, as versions from 3.3.8 to 4.5.5 are affected.

Defensive priority

Defenders should prioritize upgrading to version 4.5.6 or later to mitigate this vulnerability. They should also review their current version and assess exposure, as versions from 3.3.8 to 4.5.5 are affected.

Recommended defensive actions

• Upgrade to version 4.5.6 or later
• Review current version and assess exposure
• Monitor for potential security issues related to Object.prototype pollution
• Perform a thorough review of the system to identify potential security risks
• Implement additional security measures to prevent similar vulnerabilities
• Review and update security policies and procedures
• Conduct regular security audits and penetration testing

Evidence notes

The vulnerability is caused by the PUT /api/v1/runs/:runId/metadata endpoint passing attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) without rejecting dangerous constructor and prototype path segments. This allows for Object.prototype pollution, leading to potential security issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.