CVE-2026-6991: SQL Injection in colinhacks Zod
A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
This vulnerability in colinhacks Zod (up to version 4.3.6) involves an SQL injection flaw in an unknown function within the CUID Data Type Handler component, located in packages/zod/src/v4/core/regexes.ts. The vulnerability can be triggered remotely without user interaction and requires low privileges to exploit. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not provided any advisory or patch, and the vulnerability details have been publicly disclosed.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks remotely, potentially leading to unauthorized data access or manipulation. However, the impact is rated medium due to the limited privileges required and the low complexity of the attack. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider applying input validation or other protective measures at the application level to mitigate SQL injection risks related to this component.
CVE-2026-6991: SQL Injection in colinhacks Zod
Description
A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0
Score 5.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in colinhacks Zod (up to version 4.3.6) involves an SQL injection flaw in an unknown function within the CUID Data Type Handler component, located in packages/zod/src/v4/core/regexes.ts. The vulnerability can be triggered remotely without user interaction and requires low privileges to exploit. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has not provided any advisory or patch, and the vulnerability details have been publicly disclosed.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks remotely, potentially leading to unauthorized data access or manipulation. However, the impact is rated medium due to the limited privileges required and the low complexity of the attack. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider applying input validation or other protective measures at the application level to mitigate SQL injection risks related to this component.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-24T19:38:03.317Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Epss Score
- 0.00008
- Epss Percentile
- 0.00816
- Epss Date
- 2026-04-26
- Gcve Source
- db.gcve.eu
Threat ID: 69ed028c87115cfb682860ab
Added to database: 4/25/2026, 6:06:04 PM
Last enriched: 5/3/2026, 7:25:15 AM
Last updated: 6/9/2026, 3:26:14 PM
Views: 140
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.