Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@trigger.dev/core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.5npmPublished

    Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

    CVE-2026-73654 · GHSA-p28v-f755-9qrg

    Affected
    • npm @trigger.dev/core >= 3.3.8, <= 4.5.5
    Fixed in
    4.5.6· Vendor fix available
    Issue
    The run-metadata update endpoint PUT /api/v1/runs/:runId/metadata applies client-supplied "operations" by passing the attacker-controlled operation.key straight into new JSONHeroPath(operation.key).set(newMetadata, value) (packages/core/src/v3/runMetadata/operations.ts:22-23), with no prototype-pollution guard (@jsonhero/path@^1.0.21 does not reject proto/constructor/prototype). A request with key: "$.proto.polluted" sets Object.prototype.polluted in the webapp process. Because every plain object then inherits that property, it corrupts unrelated code process-wide and across tenants — including Prisma query building and the Prometheus metrics client — causing query failures, broken authentication for other tenants' workers, and an uncaughtException (denial of service). Only a normal, low-privilege environment API key is required (one request). Severity A single request from any holder of a normal environment API key contaminates Object.prototype in the shared webapp process,…

    Recommended action: Upgrade to 4.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →