SQL Injection Vulnerability in Wheels Product by Wheels Dev
CVE-2026-110911

9.8CRITICAL

Key Information:

Vendor

Wheels

Status
Wheels
Vendor
CVE Published:
15 October 2026

What is CVE-2026-110911?

Wheels versions 1.1.8 through 4.1.1 are vulnerable to SQL injection due to improper handling of caller-supplied quoted values. This vulnerability allows attackers to manipulate queries through dynamic finders and query builders, potentially exposing sensitive information or allowing unauthorized actions such as authentication bypass, password resets, or unauthorized token access. It is crucial for users of these affected versions to update to version 4.1.2 or higher to mitigate these risks. In addition, the query-builder's whereBetween() method in versions 4.0.0 to 4.1.1 can also be exploited under specific database configurations, further underscoring the importance of a timely upgrade.

Affected Version(s)

Wheels 1.1.8 < 4.1.2

References

https://github.com/wheels-dev/wheels/security/advisories/...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.