{"data":{"id":"41bde63d-e3c3-4de9-a49f-5c11dcfff38b","title":"CVE-2026-111451: Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy…","summary":"Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validate or escape caller-supplied values and package contents. Deploy release, version and rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds, and the flaw also enables file deletion, file overwrites, writes outside the project, and injected CFML in generated code. Unencoded display properties in generated scaffold show and admin views permit stored XSS, and stale process-ID handling in RustCFML server commands can terminate an unrelated process.","solution":"This is fixed in 4.1.2; existing affected generated views also require the documented edit.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111451","publishedAt":"2026-10-16T04:18:31.667Z","cveId":"CVE-2026-111451","cweIds":["CWE-78"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Wheels CLI","MCP tools","RustCFML"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Wheels CLI deploy, package and generator inputs allow shell command execution","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-16T06:08:59.183Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-16T06:09:02.920Z","patchAvailable":null,"disclosureDate":"2026-10-16T04:18:31.667Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null}}