← Back to search

CVE-2026-111444

9.8 CRITICALpublic exploit available

Published 2026-10-16 · Updated 2026-10-16

AI risk analysis

Summary
A SQL injection vulnerability exists in Wheels framework versions through 4.1.2 when using MySQL/MariaDB with backslash escaping enabled. Attackers can manipulate query structure by doubling single quotes without accounting for backslash escapes, allowing full database compromise.
Exploitability
Exploitation is straightforward with minimal preconditions - an application must use inline-literal SQL queries with parameterize=false or IN lists while running on MySQL/MariaDB with NO_BACKSLASH_ESCAPES enabled.
Blast radius
The impact could be severe across all applications using vulnerable Wheels versions with MySQL/MariaDB backends, potentially exposing sensitive user data, session information, and application configuration.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to 4.2.0 immediately to address this SQL injection vulnerability.
sql-injectiondatabasewebframework

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.