CVE-2026-73657

Name of the Vulnerable Software and Affected Versions Trigger.dev versions 4.4.2 through 4.5.0-rc.3

Description Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. The endpoint POST /api/v1/runs/:runParam/replay uses prisma.taskRun.findUnique({ where: { friendlyId: runParam } }) without a runtimeEnvironmentId filter. Consequently, the ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts may replay a selected run in a victim environment. An attacker with a valid environment API key can replay another tenant's run using the runParam variable, leading to the consumption of victim resources and the repetition of side effects. Additionally, when payloadType: "application/store" is used, the overrideExistingPayloadPacket() function calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check. This allows payload bytes, previously overwritten via a separate object-store path-traversal vulnerability, to become attacker-controlled input for the victim task.

Recommendations Update to version 4.5.0-rc.4.