[BUG]: Zod - CVE-2023-54404 #4147

Activity

1. github-project-automation

   added this to A2UIon Nov 10, 2026
2. github-project-automation

   moved this to Todo in A2UIon Nov 10, 2026
3. github-actions

   added

   status: needs-triageauto-managed: https://github.com/a2ui-project/a2ui/blob/main/scripts/triage.mjsauto-managed: https://github.com/a2ui-project/a2ui/blob/main/scripts/triage.mjs

   on Nov 10, 2026
4. josemontespg

   added

   status: first-line-handled

   on Nov 11, 2026
5. polina-c commented on Nov 12, 2026

   

   polina-c

   on Nov 12, 2026

   Collaborator

   More actions

   From triage bot:

   Triage suggestion:

   For humans

   Summary:
   The reporter asks to upgrade Zod in @a2ui/web_core from 3.25.76 to 4.6.6 or later, because security scanners flag CVE-2023-54404 in Zod 3 and their organization cannot adopt A2UI with it.

   Why flagged for triage:
   This issue has external input but no priority label yet.

   Suggestion:
   Set P2, the priority of the existing Zod work, and reply with what the advisory means for A2UI. The CVE record was rejected by its numbering authority on 2026-10-28, but GitHub still lists the problem as GHSA-mrhx-c7xc-m3w5 (high, patched in 4.6.6), so scanners keep flagging it. According to OSV, the 4.6.6 fix only rejects oversized input early for arrays, sets and maps with a size limit. @a2ui/web_core adds such a limit only when a catalog's JSON Schema sets maxItems (schema_loader.ts), and the basic catalog sets none, so the upgrade would not change its behavior. Moving to Zod 4 is already tracked: #2002 (make zod a peer dependency) and #2160 (remove the direct dependency on Zod, which says @a2ui/web_core must keep supporting Zod 3 for internal users). #3812 reports that validation errors break under Zod 4; #3825 is related but does not close this issue, as it fixes #3812.

   1. Add labels: P2, dependencies, lang: typescript
   2. Related issues: web: Consider making zod a peer dependency. #2002, [FEATURE]: Abstract dependency on Zod on web_core. #2160, @a2ui/web_core 0.14.0: validation errors throw TypeError under zod 4 (result.error.errors is undefined) #3812
   3. Related PRs: fix(web_core): use error.issues instead of error.errors for Zod 4 compatibility #3825

   Reply:

   Thanks for the report. The CVE record for CVE-2023-54404 was rejected on 2026-10-28, but GitHub still lists the same problem as GHSA-mrhx-c7xc-m3w5, so scanners keep flagging Zod below 4.6.6. The 4.6.6 fix only helps arrays, sets and maps that declare a size limit. @a2ui/web_core declares one only when a catalog sets maxItems, and the basic catalog does not, so upgrading would not change how it behaves. We still want to let apps use Zod 4: #2002 tracks making zod a peer dependency, and #2160 tracks removing the direct dependency on Zod. For now, @a2ui/web_core has to keep supporting Zod 3 for some of its users.

   To adjust and apply this suggestion, run in your a2ui checkout:

   tools/internal/triage_new/triage_ui.sh https://github.com/a2ui-project/a2ui/issues/4147

   For software

   <a2ui>
   root = TriageSuggestion(
     summary="""The reporter asks to upgrade Zod in `@a2ui/web_core` from 3.25.76 to 4.6.6 or later, because security scanners flag CVE-2023-54404 in Zod 3 and their organization cannot adopt A2UI with it.""",
     reason="This issue has external input but no priority label yet.",
     suggestion="""Set P2, the priority of the existing Zod work, and reply with what the advisory means for A2UI. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-54404) was rejected by its numbering authority on 2026-10-28, but GitHub still lists the problem as [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5) (high, patched in 4.6.6), so scanners keep flagging it. According to [OSV](https://osv.dev/vulnerability/CVE-2023-54404), the 4.6.6 fix only rejects oversized input early for arrays, sets and maps with a size limit. `@a2ui/web_core` adds such a limit only when a catalog's JSON Schema sets `maxItems` ([schema_loader.ts](https://github.com/a2ui-project/a2ui/blob/8bf644a37d680a227296b8c0849a7f4b328b8b73/typescript/core/web_core/src/catalog/schema_loader.ts#L482-L484)), and the basic catalog sets none, so the upgrade would not change its behavior. Moving to Zod 4 is already tracked: #2002 (make `zod` a peer dependency) and #2160 (remove the direct dependency on Zod, which says `@a2ui/web_core` must keep supporting Zod 3 for internal users). #3812 reports that validation errors break under Zod 4; #3825 is related but does not close this issue, as it fixes #3812.""",
     reply="""Thanks for the report. The CVE record for CVE-2023-54404 was rejected on 2026-10-28, but GitHub still lists the same problem as GHSA-mrhx-c7xc-m3w5, so scanners keep flagging Zod below 4.6.6. The 4.6.6 fix only helps arrays, sets and maps that declare a size limit. `@a2ui/web_core` declares one only when a catalog sets `maxItems`, and the basic catalog does not, so upgrading would not change how it behaves. We still want to let apps use Zod 4: #2002 tracks making `zod` a peer dependency, and #2160 tracks removing the direct dependency on Zod. For now, `@a2ui/web_core` has to keep supporting Zod 3 for some of its users.""",
     added_labels=["P2", "dependencies", "lang: typescript"],
     related_issues=[2002, 2160, 3812],
     related_prs=[3825]
   )
   </a2ui>
   

   _{🤖 Agent-generated}
6. Varun-S10 commented on Nov 12, 2026

   

   Varun-S10

   on Nov 12, 2026

   Collaborator

   More actions

   Hi @derek-kam, thank you for raising this issue. CVE-2023-54404 was rejected by its numbering authority, and the 4.6.6 fix in GHSA-mrhx-c7xc-m3w5 only affects arrays with a size limit, which the A2UI basic catalog does not use. While we work on full Zod 4 support in #2002, #2160, and #3812, you can pin zod to ^4.6.6 using overrides or resolutions in your package.json. Could you please try this and let us know if it works for you?
7. Varun-S10

   added

   type: bugSomething isn't workingSomething isn't working

   status: waiting-for-author-response

   on Nov 12, 2026
8. Varun-S10

   self-assigned this

   on Nov 12, 2026
9. github-actions

   removed

   status: needs-triageauto-managed: https://github.com/a2ui-project/a2ui/blob/main/scripts/triage.mjsauto-managed: https://github.com/a2ui-project/a2ui/blob/main/scripts/triage.mjs

   on Nov 12, 2026