{"uuid": "9e0b107d-1c60-4b84-a47e-6e2b7e9b2238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73654", "type": "seen", "source": "https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da", "content": "# CVE-2026-73654: CVE-2026-73654: Prototype Pollution in Trigger.dev leading to Cascading Denial of Service\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-08-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73654\n\n## Summary\nCVE-2026-73654 is a high-severity prototype pollution vulnerability in Trigger.dev. The flaw occurs during the handling of run-metadata updates through the PUT /api/v1/runs/:runId/metadata endpoint. Because user-supplied keys are parsed directly by the @jsonhero/path library without sanitization, an authenticated attacker with low privileges can pollute the global Object.prototype. This causes database queries via Prisma ORM to fail validation and induces unhandled exceptions in the Prometheus metrics client, resulting in a process-wide denial of service.\n\n## TL;DR\nUnvalidated JSON path validation in the Trigger.dev metadata update endpoint allows authenticated attackers to pollute Object.prototype, crashing Prisma queries and Prometheus metrics client instances, resulting in a system-wide denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: Low (PR:L)\n- **Scope**: Changed (S:C)\n- **Integrity Impact**: Low (I:L)\n- **Availability Impact**: High (A:H)\n- **CVSS Score**: 8.5\n- **Exploit Status**: PoC (Proof of Concept)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Trigger.dev Self-Hosted Platforms\n- Trigger.dev Cloud Worker Nodes\n- **trigger.dev**: >= 3.3.8, < 4.5.6 (Fixed in: `4.5.6`)\n\n## Mitigation\n\n- Upgrade all Trigger.dev dependencies to version 4.5.6 or higher\n- Deploy WAF content filtering rules to inspect and block prototype manipulation strings in dynamic metadata request paths\n\n**Remediation Steps:**\n1. 1. Update workspace dependencies by executing `pnpm update @trigger.dev/core@4.5.6` or updating the root package.json file.\n2. 2. Redeploy the self-hosted Trigger.dev platform with the patched version to refresh runtime worker nodes.\n3. 3. Configure reverse proxy or WAF layer to identify and drop PUT requests containing prototype traversal segments if instant patching is impossible.\n\n## References\n\n- [GitHub Security Advisory GHSA-p28v-f755-9qrg](https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg)\n- [Fix Commit 6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0](https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0)\n- [Pull Request #4316](https://github.com/triggerdotdev/trigger.dev/pull/4316)\n- [Release v4.5.6](https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73654) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-13T21:32:39.471733Z"}