CVE-2026-111451

HighCVSS 7.8

Published: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. This can lead to shell command execution on deploy hosts and the CI runner, deletion of unintended files, overwriting other vendor files, writing outside the project, injection of executable CFML, stored XSS, and termination of an unrelated process.

Risk Assessment

Attackers can leverage inputs from CI variables, branch names, packages, or an AI agent to execute arbitrary commands, delete files, or inject malicious code, potentially compromising the build and deployment environment.

Recommendation

Update Wheels CLI to version 4.1.2 or later and apply the documented edits to affected generated views.

Other vulnerabilities in Wheels CLI

CVE-2026-110909Medium
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down.

Original NVD description (English source)

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS