Command Injection and XSS Vulnerabilities in Wheels CLI by Wheels
CVE-2026-111451

7.8HIGH

Key Information:

Vendor

Wheels

Status
Wheels Cli
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111451?

The Wheels CLI versions 4.0.0 to 4.1.1 exhibit vulnerabilities that allow for command injection and Cross-Site Scripting (XSS). Insufficient validation of caller-supplied values and package content can lead to the execution of arbitrary shell commands on deploy hosts as the SSH user. Additionally, these issues enable unintended file deletions and overwrites during package removal and extraction. Generated views since version 4.1.0 may also allow for stored XSS vulnerabilities, impacting users by executing injected code. RustCFML server commands present stale process-ID handling that can terminate unrelated processes. Users are encouraged to upgrade to version 4.1.2 and review existing generated views for security compliance.

Affected Version(s)

Wheels CLI 4.0.0 < 4.1.2

References

https://github.com/wheels-dev/wheels/security/advisories/...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.