Trigger.dev's API endpoint POST /api/v1/runs/:runParam/replay in versions 4.4.2 through 4.5.0-rc.4 lacks a runtimeEnvironmentId filter when querying task runs by friendlyId, enabling any valid environment API key to replay runs belonging to other tenants. This can lead to unauthorized resource consumption and repeated side effects. Furthermore, when the payloadType is "application/store", the function overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without verifying integrity, allowing attacker-controlled payload bytes to be injected via a separate object-store path traversal vulnerability. The vulnerability is addressed in version 4.5.0-rc.4.

An attacker with a valid environment API key can replay task runs belonging to other tenants, causing unauthorized consumption of resources and repeated execution of side effects. The lack of integrity checks on payload data when using "application/store" payloadType allows injection of attacker-controlled input into victim tasks, potentially leading to further compromise or disruption. The CVSS score of 4.2 reflects a medium severity impact with no confidentiality loss but integrity and availability impacts.

This vulnerability is fixed in trigger.dev version 4.5.0-rc.4. Users should upgrade to version 4.5.0-rc.4 or later to remediate the issue. Patch status is not explicitly confirmed beyond this fix version; check the vendor advisory for the latest remediation guidance.