THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-73654 (HIGH 8.5) — Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages

[NVD] CVE-2026-73654 (HIGH 8.5) — Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages

lownvdPublished 2026-08-13

CVE-2026-73654 CVSS: 8.5 HIGH Published: 2026-08-13T20:17:30.007

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecti

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73654