CVE-2026-110909

MediumCVSS 5.0

Published: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Risk Assessment

An attacker could capture the reload password and project code or perform unintended state-changing operations against another local application's server, leading to data leakage or modification.

Recommendation

Update Wheels CLI to version 4.1.1 or later, which includes fixes to the CLI and application template.

Other vulnerabilities in Wheels CLI

CVE-2026-111451High
Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. This can lead to shell command execution on deploy hosts and the CI runner, deletion of unintended files, overwriting other vendor files, writing outside the project, injection of executable CFML, stored XSS, and termination of an unrelated process.

Original NVD description (English source)

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS