A vulnerability in the consumer data type handler of the Zod library can lead to SQL injection when an attacker manipulates input to the regex function. The flaw originates from improper neutralization of input characters (CWE‑74) and is equivalent to a classic SQL injection attack (CWE‑89). If exploited, an attacker could execute arbitrary queries against an underlying database, potentially exposing confidential data or modifying it, resulting in confidentiality and integrity loss for the affected application.

Any installation of colinhacks Zod version 4.3.6 or earlier is susceptible. The vulnerability involves the CUID data type handler located in packages/zod/src/v4/core/regexes.ts and therefore applies to all projects that import and use that data type or its validation function.

The CVSS base score of 5.3 indicates moderate impact. The EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The flaw can be triggered remotely with crafted input; however, the vendor has not published a patch or workaround. Because the weakness is not listed in CISA’s KEV catalog, there is no evidence of operational exploitation as of the last update, but organizations should anticipate that the public disclosure could lead to future attacks.