CVE-2026-111444
9.8CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Remote, unauthenticated attackers can execute arbitrary SQL queries against the database and compromise the entire system. They only need access to endpoints that pass untrusted input into unparameterized query paths.
Root cause
The framework sanitizes inputs by doubling single quotes without handling backslash escapes, allowing backslashes to escape the quote when MySQL/MariaDB runs without NO_BACKSLASH_ESCAPES.
Affected systems
Wheels through 4.1.2 on MySQL/MariaDB
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Wheels to version 4.2.0 or later. As an immediate workaround, enable the NO_BACKSLASH_ESCAPES SQL mode on your MySQL/MariaDB instances and ensure where queries use proper parameter binding.
$ box install wheels@^4.2.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.