CVE-2026-110911

Summary

Wheels framework contains a SQL injection vulnerability in versions 1.1.8 through 4.1.1 where user-supplied quoted values are incorrectly parsed as SQL, allowing attackers to inject malicious SQL code through dynamic finders and query builder methods. This affects authentication, password reset, and token lookup functionality.

Exploitability

Exploitation is straightforward for applications that pass request data to affected APIs, requiring only a properly crafted input that doubles single quotes to trigger the SQL injection.

Blast radius

The vulnerability can lead to unauthorized access to user accounts, password resets, and sensitive data across all affected applications using Wheels framework versions 1.1.8 through 4.1.1.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Wheels 4.1.2 or later to fix both the SQL injection vulnerability and the query-builder whereBetween() issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.