SQL Injection Vulnerability in Wheels Product by Wheels Dev
CVE-2026-111444

9.8CRITICAL

Key Information:

Vendor

Wheels

Status
Wheels
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111444?

The Wheels product version 4.1.2 is vulnerable to SQL injection attacks due to improper handling of request data in inline-literal paths. This vulnerability is particularly present when backslash escaping is enabled in MySQL/MariaDB configurations, allowing an attacker to manipulate queries by exploiting opt-in parameterize=false queries and IN lists. Developer-written WHERE strings, such as BETWEEN bounds and function arguments, are also impacted when the parser fails to bind appropriately. This vulnerability can be mitigated by upgrading to version 4.2.0, where the issue has been addressed properly.

Affected Version(s)

Wheels 0 < 4.2.0

References

https://github.com/wheels-dev/wheels/security/advisories/...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.