CVE-2026-73657

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73657
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73657.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73657
Aliases
  • GHSA-jx48-qfwm-xq67
Published
2026-08-13T21:15:13Z
Modified
2026-09-10T03:31:07Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Trigger.dev: Cross-tenant payload poisoning via packet write + replay
Details

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, POST /api/v1/runs/:runParam/replay in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses prisma.taskRun.findUnique({ where: { friendlyId: runParam } }) without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant's run by friendlyId, consuming victim resources and repeating side effects; when payloadType: "application/store" is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-345",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73657.json"
}
References

Affected packages

Git / github.com/triggerdotdev/trigger.dev

Affected ranges

Type
GIT
Repo
https://github.com/triggerdotdev/trigger.dev
Events
Introduced
e36b75785e78e1bba6af71f47d0c9af54ce2d88b
Fixed
e1950778e2f2007e2d432b8f8a8fc89531c51f19
Fixed
e0681d23943441bb5f0294868502950d5bf374c5
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.4.2"
        },
        {
            "fixed": "4.5.0-rc.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

build-ecr-default-policy.*
build-ecr-default-policy.rc0
helm-v4.*
helm-v4.4.4
helm-v4.4.5
helm-v4.4.6
helm-v4.5.0-rc.0
helm-v4.5.0-rc.1
helm-v4.5.0-rc.3
Other
re2-prod-2026-04-08
re2-prod-supervisor-ndots-override
re2-prod-uncaught-exception
re2-test-2026-04-08
re2-test-private-link
re2-test-supervisor-ndots-override
re2-test-uncaught-exception
v.*
v.docker.4.4.2
v.docker.4.4.3
v.docker.4.4.4
v.docker.4.4.5
v.docker.4.4.6
v.docker.4.5.0-rc.0
v.docker.4.5.0-rc.1
v.docker.4.5.0-rc.2
v.docker.4.5.0-rc.3
v4.*
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.5.0-rc.0
v4.5.0-rc.1
v4.5.0-rc.2
v4.5.0-rc.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73657.json"