Executive brief
Trigger.dev is a platform for building and deploying AI agents and workflows. A path traversal vulnerability in versions 4.4.2 through 4.5.0-rc.4 allowed authenticated users with valid API keys to bypass storage isolation and access or modify other tenants' task payloads by crafting specially-formatted presigned URLs that escape the intended storage prefix.
Technical details
The vulnerability exists in Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() within apps/webapp/app/v3/objectStoreClient.server.ts, which construct object-store keys from user-controlled packet parameters without validation. The presign API endpoint (apps/webapp/app/routes/api.v1.packets.$.ts) accepts arbitrary path segments via params["*"] without rejecting dot segments (..) or validating per-resource ownership. Due to WHATWG path normalization collapsing ".." segments after URL construction but before signing, an attacker with a valid environment API key could craft presigned URLs for another tenant's keys. The fix adds assertSafePacketRelativePath() validation that rejects empty paths, leading slashes, backslashes, empty segments, and traversal operators before key construction, ensuring consistent behavior across storage backends.
Affected products
- Trigger.dev Trigger.dev 4.4.2 to 4.5.0-rc.4
Timeline
- 2026-08-13: disclosed
- 2026-06-05: patched: Fix merged in PR #3830, released in version 4.5.0-rc.5