CVE-2026-110911
9.8CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Remote, unauthenticated attackers can execute arbitrary SQL queries against the database to bypass authentication or steal and alter sensitive data. They only need network access to application endpoints that pass user input into affected Wheels finder methods.
Root cause
The framework's SQL parser mishandles escaped quotes by incorrectly treating doubled single quotes as the end of a string literal.
Affected systems
Wheels 1.1.8 through 4.1.1 (whereBetween() issue specifically affects 4.0.0 through 4.1.1)
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Wheels to version 4.1.2. If you cannot patch immediately, audit caller-supplied string values and avoid passing untrusted input directly into dynamic finders, string/UUID key lookups, and where() clauses.
$ box install wheels@4.1.2AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.