Description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service. This issue is fixed in version 4.5.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-13T20:17:30.007Z",
  "pubdate": "2026-08-13T20:17:30.007Z",
  "executiveSummary": "A prototype pollution vulnerability exists in the Trigger.dev platform, specifically within the PUT /api/v1/runs/:runId/metadata endpoint. The vulnerability arises from improper handling of attacker-controlled operation.key values passed directly to new JSONHeroPath(operation.key).set(newMetadata, value) within packages/core/src/v3/runMetadata/operations.ts, lacking validation against dangerous constructor and prototype path segments. An authenticated adversary possessing a standard environment API key can successfully exploit this flaw to pollute Object.prototype in the shared webapp process. This pollution corrupts underlying Prisma database queries and Prometheus metrics labels, breaks authentication mechanisms for other tenants' workers, and ultimately triggers a process-wide denial of service. The risk implications are severe due to cross-tenant impact within a shared execution context. Exploitation requires standard environment API key access and the ability to issue authenticated HTTP PUT requests to the vulnerable API endpoint. The issue is fully resolved in version 4.5.6.",
  "technicalDetails": "The vulnerability resides in the Trigger.dev core codebase, specifically inside packages/core/src/v3/runMetadata/operations.ts. The root cause is the unsafe consumption of untrusted input supplied via the PUT /api/v1/runs/:runId/metadata endpoint. During metadata update operations, the application extracts the attacker-controlled operation.key property and instantiates a path manipulation utility via new JSONHeroPath(operation.key).set(newMetadata, value). Because the implementation fails to sanitize or reject dangerous constructor and prototype navigation segments such as __proto__, constructor, and prototype, an adversary can manipulate object property resolution across the JavaScript runtime environment.\nThe attack flow proceeds as follows: First, an attacker authenticates using a normal environment API key. Second, the attacker crafts a malicious HTTP PUT request directed at the /api/v1/runs/:runId/metadata endpoint, embedding prototype pollution payloads within the operation.key field. Third, the backend application processes the request and executes the vulnerable JSONHeroPath set method, which traverses and modifies the properties of the global Object.prototype in the shared webapp process.\nThe post-exploitation impact spans the entire application process. Because many internal modules rely on standard object properties and method inheritance, polluting Object.prototype corrupts Prisma ORM query construction, alters Prometheus monitoring and labeling states, breaks authentication validation routines for other tenants' worker nodes, and culminates in a process-wide denial of service. The vulnerable component is the metadata operation handler across versions 3.3.8 up to 4.5.6. The flaw requires network exposure of the API endpoint and a valid environment API key to satisfy initial authentication requirements, but does not necessitate elevated administrative privileges."
}