Read the docs
TI-2026-75145 Aliases CVE-2026-111444GHSA-cpjx-54pq-8rcv

SQL injection in Wheels on MySQL and MariaDB via unbound literals

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Wheels before 4.2.0 is affected on MySQL and MariaDB servers with backslash escaping enabled. The framework doubles single quotes but ignores backslash escapes, so a crafted value can alter the SQL query (CWE-89). An unauthenticated remote attacker can reach this when an application passes request data to inline-literal query paths, such as parameterize=false queries, IN lists or BETWEEN bounds.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 24th percentileScored 2026-11-07
Fix Fixed Wheels (Wheels): 4.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WheelsWheelsbefore 4.2.04.2.0Patch availableCNA
  • Wheels VendorWheels Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA

Remediation

Upgrade Wheels to 4.2.0, which fixes this issue. Bound query paths are not affected, and whereBetween() is bound from 4.1.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Wheels (Wheels) Fixed in 4.2.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Wheels 4.2.0

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-75147 Wheels exposes unprotected development tools to remote clientsPriority MEDIUM 43
    • TI-2026-75148 Wheels nested form updates can modify another parent's recordsPriority LOW 37
    • TI-2026-75146 Wheels findByKey() and exists(key=) ignore scope conditionsPriority LOW 37
    Show all 6 records →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111444
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Alias added: GHSA-cpjx-54pq-8rcv

References

Advisory 1

  • TI-2026-74581 SQL injection in Wheels query builder and dynamic finders CVSS 3.1CRITICAL 9.8
  • TI-2026-75147 Wheels exposes unprotected development tools to remote clients CVSS 3.1HIGH 8.6
  • TI-2026-75148 Wheels nested form updates can modify another parent's records CVSS 3.1HIGH 8.1
  • TI-2026-75146 Wheels findByKey() and exists(key=) ignore scope conditions CVSS 3.1HIGH 8.1
  • TI-2026-75152 Command injection and unsafe file handling in Wheels CLI CVSS 3.1HIGH 7.8
  • TI-2026-75144 Wheels lets unauthenticated clients enter a separate test context CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences