Read the docs
TI-2026-74581 Aliases CVE-2026-110911GHSA-2wh3-67f4-gxgc

SQL injection in Wheels query builder and dynamic finders

Priority MEDIUM 49CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Wheels from 1.1.8 before 4.1.2 has an SQL injection flaw (CWE-89) in its query APIs. The parser treats a doubled single quote as the end of a literal, so request data passed to these APIs is parsed as SQL. An unauthenticated remote attacker can reach authentication, token or password-reset lookups and data when applications pass request data to these APIs. Similar whereBetween() bounds in 4.0.0 through 4.1.1 can alter SQL on MySQL and MariaDB with backslash escaping.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix Fixed Wheels (Wheels): 4.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WheelsWheels1.1.8 to before 4.1.24.1.2Patch availableCNA
  • Wheels VendorWheels Affected 1.1.8 to before 4.1.2 Fixed in 4.1.2 Patch available CNA

Remediation

Upgrade Wheels to 4.1.2, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Wheels (Wheels) Fixed in 4.1.2

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-110911
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-16 Alias added: GHSA-2wh3-67f4-gxgc

References

Advisory 1

  • TI-2026-75147 Wheels exposes unprotected development tools to remote clients CVSS 3.1HIGH 8.6
  • TI-2026-75145 SQL injection in Wheels on MySQL and MariaDB via unbound literals CVSS 3.1CRITICAL 9.8
  • TI-2026-75148 Wheels nested form updates can modify another parent's records CVSS 3.1HIGH 8.1
  • TI-2026-75146 Wheels findByKey() and exists(key=) ignore scope conditions CVSS 3.1HIGH 8.1
  • TI-2026-75152 Command injection and unsafe file handling in Wheels CLI CVSS 3.1HIGH 7.8
  • TI-2026-75144 Wheels lets unauthenticated clients enter a separate test context CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences