Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Wheels 1.1.8‑4.1.1 lets attackers inject database commands

CVE-2026-110911 · published today
Summary

When a web application built with Wheels version 1.1.8 through 4.1.1 passes user‑provided values to certain lookup functions, the code can misinterpret the input and run extra database commands. This could allow someone to see or change data such as passwords or reset tokens without permission. Updating Wheels to version 4.1.2 or later removes the problem.

What to do
  • Update wheels wheels to version 4.1.2 or later.
Affected software
VendorProductAffected versions
wheels wheels < 4.1.2
Original advisory text
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) an...
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-110911 · NVD
CVE-2026-110911 · MITRE
Track software like this
Free during beta