SQL Injection Vulnerability in colinhacks Zod's CUID Data Type Handler

CVE-2026-6991

What is CVE-2026-6991?

A vulnerability has been discovered in the colinhacks Zod library, specifically affecting versions up to 4.3.6. This flaw resides within an ambiguous function located in 'packages/zod/src/v4/core/regexes.ts', which is part of the CUID Data Type Handler. By manipulating inputs, an attacker could execute SQL injection attacks remotely, potentially compromising the security of affected applications. Despite early notification to the vendor regarding this issue, there has been no response or mitigation efforts reported.

References