Local Development Server Vulnerability in Wheels CLI by Wheels

CVE-2026-110909

What is CVE-2026-110909?

Wheels CLI versions up to 4.1.0 are susceptible to a security flaw that allows unauthorized local applications to interact with the CLI. The CLI fails to verify that the HTTP requests from a local development server originate from the correct project. As a result, a malicious process listening on the CLI's target port can intercept sensitive information such as the project's reload password and other commands. This vulnerability also allows unintended state changes in a different local application's server and database. A fix was implemented in version 4.1.1 to address these security issues.

References