Trigger.dev, a managed platform for AI agents, contains a flaw in the "/api/v1/runs/:runParam/replay" endpoint that allows a user with any valid environment API key to replay another tenant’s run by specifying its friendlyId. The replayed run executes in the victim’s environment and, when the payload type is \"application/store\", the stored payload bytes can be overwritten through a separate object‑store path‑traversal vulnerability. This enables the attacker to inject malicious payloads that are executed or processed within the victim tenant, effectively poisoning the tenant’s task runs.

Affected deployments are running Trigger.dev versions from 4.4.2 up to and including 4.5‑0‑rc.4. Versions before 4.4.2 do not contain the vulnerable endpoint, while 4.5.0‑rc.4 and later include the patch that restricts replay to the same runtimeEnvironmentId and adds an integrity check before overwriting payload packets.

The CVSS score of 4.2 indicates moderate impact, and there is no EPSS data available; the issue is not listed in the CISA KEV catalog. The attack requires possession of a valid environment API key, so it is limited to actors who have gained tenant‑level access or compromised key material. Once an attacker can replay a run, they can consume resources and potentially execute attacker‑controlled payloads in the victim environment, but the vulnerability does not deliver arbitrary code execution across the network directly.