CVE-2026-6991

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6991", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-24T19:38:03.317Z", "datePublished": "2026-04-25T17:45:14.113Z", "dateUpdated": "2026-04-27T13:30:16.287Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-25T17:45:14.113Z"}, "title": "colinhacks Zod CUID Data Type regexes.ts sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "colinhacks", "product": "Zod", "versions": [{"version": "4.3.0", "status": "affected"}, {"version": "4.3.1", "status": "affected"}, {"version": "4.3.2", "status": "affected"}, {"version": "4.3.3", "status": "affected"}, {"version": "4.3.4", "status": "affected"}, {"version": "4.3.5", "status": "affected"}, {"version": "4.3.6", "status": "affected"}], "cpes": ["cpe:2.3:a:zod:zod:*:*:*:*:*:*:*:*"], "modules": ["CUID Data Type Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-24T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-24T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-24T21:43:07.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "dsonbacker (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359543", "name": "VDB-359543 | colinhacks Zod CUID Data Type regexes.ts sql injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/359543/cti", "name": "VDB-359543 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796749", "name": "Submit #796749 | colinhacks Zod <=4.3.6 Improper Input Validation", "tags": ["third-party-advisory"]}]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/796749", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:30:11.851338Z", "id": "CVE-2026-6991", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:30:16.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6991", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:30:11.851338Z"}}}], "references": [{"url": "https://vuldb.com/submit/796749", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:30:04.985Z"}}], "cna": {"title": "colinhacks Zod CUID Data Type regexes.ts sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "dsonbacker (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:zod:zod:*:*:*:*:*:*:*:*"], "vendor": "colinhacks", "modules": ["CUID Data Type Handler"], "product": "Zod", "versions": [{"status": "affected", "version": "4.3.0"}, {"status": "affected", "version": "4.3.1"}, {"status": "affected", "version": "4.3.2"}, {"status": "affected", "version": "4.3.3"}, {"status": "affected", "version": "4.3.4"}, {"status": "affected", "version": "4.3.5"}, {"status": "affected", "version": "4.3.6"}]}], "timeline": [{"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-24T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-24T21:43:07.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359543", "name": "VDB-359543 | colinhacks Zod CUID Data Type regexes.ts sql injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/359543/cti", "name": "VDB-359543 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796749", "name": "Submit #796749 | colinhacks Zod <=4.3.6 Improper Input Validation", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-25T17:45:14.113Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6991", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:30:16.287Z", "dateReserved": "2026-04-24T19:38:03.317Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-25T17:45:14.113Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:zod:zod:*:*:*:*:*:*:*:*"], "modules": ["CUID Data Type Handler"], "product": "Zod", "vendor": "colinhacks", "versions": [{"status": "affected", "version": "4.3.0"}, {"status": "affected", "version": "4.3.1"}, {"status": "affected", "version": "4.3.2"}, {"status": "affected", "version": "4.3.3"}, {"status": "affected", "version": "4.3.4"}, {"status": "affected", "version": "4.3.5"}, {"status": "affected", "version": "4.3.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en colinhacks Zod hasta la versi\u00f3n 4.3.6. El elemento afectado es una funci\u00f3n desconocida del archivo packages/zod/src/v4/core/regexes.ts del componente Gestor de Tipo de Datos CUID. La ejecuci\u00f3n de una manipulaci\u00f3n puede conducir a una inyecci\u00f3n SQL. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-6991", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6991", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T13:30:11.851338Z", "version": "2.0.3"}}]}, "published": "2026-04-25T18:16:19.240", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/796749"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359543"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359543/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://vuldb.com/submit/796749"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Zod", "source": "cna", "vendor": "colinhacks"}, "product": "zod", "vendor": "zod"}], "analysis": {"en": {"generated_at": "2026-04-28T05:31:13.236048+00:00", "value": {"mitigation_remediation": ["Upgrade Zod to the latest version where the CUID regex handling bug is fixed, if such a release is available.", "If an upgrade is not immediately possible, disable or remove usage of the CUID data type in the application so the vulnerable code path is not exercised.", "Implement strict input validation or parameterize all database queries that interact with user-provided data to mitigate the impact of a potential SQL injection."], "summary": {"action": "Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "Any installation of colinhacks Zod version 4.3.6 or earlier is susceptible. The vulnerability involves the CUID data type handler located in packages/zod/src/v4/core/regexes.ts and therefore applies to all projects that import and use that data type or its validation function.", "description_and_impact": "A vulnerability in the consumer data type handler of the Zod library can lead to SQL injection when an attacker manipulates input to the regex function. The flaw originates from improper neutralization of input characters (CWE\u201174) and is equivalent to a classic SQL injection attack (CWE\u201189). If exploited, an attacker could execute arbitrary queries against an underlying database, potentially exposing confidential data or modifying it, resulting in confidentiality and integrity loss for the affected application.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates moderate impact. The EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The flaw can be triggered remotely with crafted input; however, the vendor has not published a patch or workaround. Because the weakness is not listed in CISA\u2019s KEV catalog, there is no evidence of operational exploitation as of the last update, but organizations should anticipate that the public disclosure could lead to future attacks."}}}}, "created": "2026-04-27T18:45:11.309558+00:00", "updated": "2026-04-28T05:45:23.287628+00:00", "vendors": ["zod", "zod$PRODUCT$zod"]}