CVE-2026-111451

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.

• CWE-78

• https://github.com/wheels-dev/wheels/security/advisories/GHSA-cghp-86c6-6fjc

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111446Wheels 4.0.0 through 4.1.2 exposes password-less development…8.6
• CVE-2026-111447Wheels 1.1 through 4.1.2 resolves nestedProperties() records…8.1
• CVE-2026-111448Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons…3.7
• CVE-2026-111449Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions …5.9
• CVE-2026-11145Race in Geolocation in Google Chrome on Android prior to 149…5.3
• CVE-2026-111450Wheels through 4.1.1 derives its default production error-em…5.9
• CVE-2026-111458The fanx_fingerprint function in ssl/sslxprint.c of ssldump …6.8
• CVE-2026-11146Insufficient validation of untrusted input in Chromoting in …9.6
• CVE-2026-11147Use after free in WebML in Google Chrome on Windows prior to…8.8
• CVE-2026-111472An SQL injection vulnerability has been discovered in TSG Pr…9.3
• CVE-2026-11148Inappropriate implementation in Payments in Google Chrome on…6.5
• CVE-2026-11149Insufficient validation of untrusted input in Extensions in …7.5