Vulnerability in @trigger.dev/core (CVE-2026-73654)

Summary

The run-metadata update endpoint PUT /api/v1/runs/:runId/metadata applies client-supplied
"operations" by passing the attacker-controlled operation.key straight into
new JSONHeroPath(operation.key).set(newMetadata, value)
(packages/core/src/v3/runMetadata/operations.ts:22-23), with no prototype-pollution guard
(@jsonhero/path@^1.0.21 does not reject __proto__/constructor/prototype).

A request with key: "$.__proto__.polluted" sets Object.prototype.polluted in the webapp
process. Because every plain object then inherits that property, it corrupts unrelated code
process-wide and across tenants — including Prisma query building and the Prometheus metrics
client — causing query failures, broken authentication for other tenants' workers, and an
uncaughtException (denial of service). Only a normal, low-privilege environment API key is
required (one request).

Severity

A single request from any holder of a normal environment API key contaminates Object.prototype
in the shared webapp process, breaking other tenants' workers (scope change) and degrading/
crashing the process (high availability impact). Prototype pollution is also a primitive for
further gadget chains (integrity/confidentiality).

Affected versions

• Introduced in commit 34f8bd588 ("Add ability to update parent and root run metadata from
  children", PR #1563, 2025-01-08) — the JSONHeroPath(operation.key).set() sink is present from
  the first comm…