CVE-2026-110911

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.

• CWE-89

• https://github.com/wheels-dev/wheels/security/advisories/GHSA-96rm-h22v-925x

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11090Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-110904ApostropheCMS before 4.33.0 allows authentication bypass for…5.3
• CVE-2026-110907Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.3…7.5
• CVE-2026-110908Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and so…8.8
• CVE-2026-110909Wheels CLI through 4.1.0 does not verify that the local deve…5
• CVE-2026-11091Inappropriate implementation in Dawn in Google Chrome prior …8.8
• CVE-2026-110912In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input…7.1
• CVE-2026-11092Insufficient policy enforcement in DevTools in Google Chrome…8.8
• CVE-2026-110923A flaw was found in OpenSSH. During an sftp copy, a maliciou…6.5
• CVE-2026-110924A flaw was found in OpenSSH. With GSSAPI authentication enab…4.8
• CVE-2026-110925A flaw was found in OpenSSH. A username entered on the ssh c…5.4
• CVE-2026-110926A flaw was found in OpenSSH. When compression is negotiated,…5.3