Repository navigation
[Security Issue]: Current Zod version is affected by CVE-2023-54404 #3610
Description
Reference: https://www.cve.org/CVERecord?id=CVE-2023-54404
Let's bump the zod version to 4.6.6 at least to address the security issue. Web core's zod still use version "^3.25.76".
a2ui/typescript/core/web_core/package.json
Line 319 in 409ded2
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
jacobsimionato commentedon Oct 26, 2026
@ditman can you take a look at this and decide if we need to take action urgently?
jacobsimionato commentedon Oct 26, 2026
I wonder if the Zod authors will release a patched version of Zod 3 we could advance to.
ditman commentedon Oct 26, 2026
Yeah, the jump to zod4 is not trivial :) Also, zod v3 seems to be legacy, so it seems unlikely that whatever fix is going to get backported (?)
louis-bompart commentedon Oct 29, 2026
FYI, the CVE has now been rejected by its CNA (see https://www.cve.org/CVERecord?id=CVE-2023-54404).
More details from the author in this GitHub Issue: github/advisory-database#10750
It doesn't mean that jumping to Zod 4 wouldn't be nice, but (IMHO) you could crank the priority down on this one