CVE-2026-73654: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the

Trigger.dev, a platform for building AI agents and workflows, had a security flaw in versions 3.3.8 to 4.5.6 where the PUT /api/v1/runs/:runId/metadata endpoint (a web address for updating run information) accepted attacker-controlled input without proper filtering. This allowed attackers with a normal API key to perform prototype pollution (a type of attack that corrupts shared object properties in JavaScript), which could break database queries, disrupt other users' authentication, and crash the application.