Trigger.dev Run Metadata Prototype Pollution (JSONHeroPath)

Technical Analysis

The PUT /api/v1/runs/:runId/metadata endpoint passes an attacker-controlled operation.key directly into new JSONHeroPath(operation.key).set(newMetadata, value) without filtering dangerous path segments like __proto__ or constructor.prototype. Because any caller holding a normal environment API key can reach this endpoint, a low-privilege tenant can inject a malicious path to pollute the global Object.prototype in the shared multi-tenant webapp process. This corrupts shared state used by Prisma ORM queries and Prometheus metric labels, and can interfere with worker authentication logic for other tenants, effectively crossing tenant isolation boundaries within a single shared agent orchestration service. The result is a process-wide denial of service or integrity corruption affecting unrelated tenants' agent workflows, not just the attacker's own environment.

Affected Systems

Trigger.dev, JSONHeroPath

Detection Signatures

• PUT requests to /api/v1/runs/:runId/metadata with operation.key values containing '__proto__', 'constructor', or 'prototype'
• Unexpected appearance of polluted properties on shared Object.prototype in Node.js process logs
• Sudden Prisma query errors or malformed Prometheus metric labels correlated with metadata update API calls
• Unexplained authentication failures for unrelated tenants/workers following metadata API activity

Remediation Steps

1. 1

   Upgrade Trigger.dev

   Update to version 4.5.6 or later, which rejects dangerous constructor/prototype path segments in the metadata operation handling.

2. 2

   Sanitize path input

   Add explicit denylisting/validation of __proto__, constructor, and prototype segments before passing any user-controlled key into JSONHeroPath or similar dynamic path-setting libraries.

3. 3

   Isolate tenant processes

   Reduce blast radius by isolating tenant execution contexts (separate processes/workers) so a single tenant cannot pollute globally shared state affecting others.

4. 4

   Monitor for pollution indicators

   Add runtime integrity checks or freezing of Object.prototype (Object.freeze) where feasible, and alert on anomalous keys appearing on prototype objects.

5. 5

   Audit API key scoping

   Review whether standard environment API keys should have write access to metadata endpoints capable of arbitrary key injection, and apply least-privilege scoping.