HighVulnerability
CVE-2026-111451: Wheels CLI deploy, package and generator inputs allow shell command execution
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-111451
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
Wheels CLI versions 4.0.0 through 4.1.1 insufficiently validate or escape caller-supplied values and package contents. Deploy release, version and rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds, and the flaw also enables file deletion, file overwrites, writes outside the project, and injected CFML in generated code. Unencoded display properties in generated scaffold show and admin views permit stored XSS, and stale process-ID handling in RustCFML server commands can terminate an unrelated process.
Mitigation
This is fixed in 4.1.2; existing affected generated views also require the documented edit.
Related items
- CriticalCVE-2026-111322: Archon missing authentication exposes control API to unauthenticated attackersSimilar attack · NVD/CVE Database
- MediumFake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents EarlySimilar attack · The Hacker News
- MediumRansomware extortion gets personal as attackers target employees’ familiesSimilar attack · CSO Online
- MediumLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsSimilar attack · The Hacker News
- MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSimilar attack · Dark Reading