CVE-2026-73658: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5,

Trigger.dev, a platform for building AI agents and workflows, had a security vulnerability from version 4.4.2 through 4.5.0-rc.5 where user input was improperly validated when creating file paths. An attacker with a valid API key could exploit path normalization (the process of simplifying file path references like converting '../' to parent directories) to access or modify files belonging to other customers' data. This vulnerability allowed unauthorized access to task payloads (the data that workflows process).