This vulnerability in colinhacks Zod (up to version 4.3.6) involves an SQL injection flaw in an unknown function of the CUID Data Type Handler component, located in packages/zod/src/v4/core/regexes.ts. The issue can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not provided any advisory or patch, and the exploit details have been publicly disclosed.

Successful exploitation could allow an attacker to perform SQL injection remotely, potentially leading to unauthorized data access or manipulation within applications using the affected Zod versions. The impact is rated medium based on the CVSS score and vector, with limited complexity and no required user interaction. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by avoiding use of affected versions or applying custom input validation and sanitization around the vulnerable component until an official patch is available.