Trigger.dev CVE-2026-73654

Exploitation requires possession of a valid Trigger.dev environment API key at the low-privilege level (CVSS PR:L confirmed). Any key issued to a legitimate tenant suffices - no administrative, project-owner, or elevated role is needed. The vulnerable endpoint (PUT /api/v1/runs/:runId/metadata) is a standard part of the platform's run management API and requires no non-default feature flag or special configuration to be present. Unauthenticated exploitation is not possible. Cross-tenant impact is bounded by the shared webapp process architecture: self-hosted deployments with per-tenant process isolation would limit blast radius to the attacker's own process, though availability impact would still apply. The run ID used in the request path does not need to belong to the attacker - any run ID accepted by the endpoint is sufficient to trigger the prototype pollution.

The CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H) accurately reflects the real-world threat profile. The scope-change metric (S:C) is the most operationally significant signal: a single authenticated tenant can disrupt availability and integrity for every other tenant sharing the webapp process, transforming a low-privilege credential into a cross-tenant weapon. The PR:L rating is correct - any holder of a standard environment API key qualifies, meaning the effective attacker pool includes all registered users of a shared deployment. Attack complexity is genuinely low: no race conditions, no special sequencing, and the JSONHeroPath vector is well-understood in the Node.js security community. No EPSS data was provided, and this CVE does not appear in the CISA KEV catalog, so active exploitation remains unconfirmed; however, the mechanically simple attack chain and publicly available PR diff supply enough information for a competent researcher to reproduce the issue without a dedicated proof-of-concept. The absence of confidentiality impact (C:N) is plausible given the current description, but prototype pollution can sometimes be chained to read injected properties - this secondary risk is not confirmed by available data and should not be assumed. Self-hosted single-tenant deployments face a lower blast radius (no cross-tenant scope change) but are still vulnerable to self-inflicted availability loss.

An attacker holding any valid Trigger.dev environment API key sends a PUT request to /api/v1/runs/<any-runId>/metadata with a metadata operation whose key is set to __proto__.someProperty and value to an attacker-chosen primitive. The shared webapp process applies the mutation via JSONHeroPath.set(), writing to Object.prototype. Immediately, all objects instantiated in the process - including Prisma query builder instances and Prometheus label objects - inherit the injected property, causing malformed database queries and authentication failures that affect every other tenant until the process is restarted. The PR diff and CVE description together provide sufficient detail for an experienced researcher to construct this payload without an explicit proof-of-concept.