Read the docs
TI-2026-75152 Aliases CVE-2026-111451GHSA-p9x9-cr8j-4m4h

Command injection and unsafe file handling in Wheels CLI

Priority LOW 35CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Wheels CLI from 4.0.0 before 4.1.2 does not validate or escape caller-supplied values and package contents. A local user with no privileges can make deploy values or packages run shell commands as the SSH user on deploy hosts or the CI runner, once a user takes an action such as a deploy or build (CWE-78). The flaw also allows file deletion and overwrites and, through unencoded views, stored cross-site scripting.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00141 3rd percentileScored 2026-11-07
Fix Fixed Wheels CLI (Wheels): 4.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WheelsWheels CLI4.0.0 to before 4.1.24.1.2Patch availableCNA
  • Wheels CLI VendorWheels Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available CNA

Remediation

Upgrade Wheels CLI to version 4.1.2, which fixes the flaw. Existing generated views with unencoded display properties also require the documented edit.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Wheels CLI (Wheels) Fixed in 4.1.2

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111451
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 Alias added: GHSA-p9x9-cr8j-4m4h
  4. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-74581 SQL injection in Wheels query builder and dynamic finders CVSS 3.1CRITICAL 9.8
  • TI-2026-75147 Wheels exposes unprotected development tools to remote clients CVSS 3.1HIGH 8.6
  • TI-2026-75145 SQL injection in Wheels on MySQL and MariaDB via unbound literals CVSS 3.1CRITICAL 9.8
  • TI-2026-75148 Wheels nested form updates can modify another parent's records CVSS 3.1HIGH 8.1
  • TI-2026-75146 Wheels findByKey() and exists(key=) ignore scope conditions CVSS 3.1HIGH 8.1
  • TI-2026-75144 Wheels lets unauthenticated clients enter a separate test context CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences