Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111451

Quick assessment

Affected
Wheels Wheels CLI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wheels CLI 4.0.0 至 4.1.1 版本对调用方提供的值及包内容进行了不足的验证或转义。部署、发布、版本回滚等操作的值可在部署主机上以 SSH 用户身份执行 shell 命令，并在构建期间于 CI 运行器上执行。包移除和销毁路径可能删除非预期文件；包解压可能覆盖其他供应商文件；生成器名称可能向项目目录外写入文件，或在生成的代码中注入可执行的 CFML 代码。输入可能源自 CI 变量、分支名称、包，或使用该 CLI 的 MCP 工具的 AI 代理。此外，自 4.1.0 版本起，生成的脚手架“显示”视图中

CVSS 7.8 · High EPSS 0.14% · P3

Affected Version Matrix 1

VendorProduct Version RangeStatus
Wheels Wheels CLI 4.0.0< 4.1.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111451

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Wheels Wheels CLI 4.0.0 ~ 4.1.2 -

II. Public POCs for CVE-2026-111451

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111451

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111451 (1)

Same Patch Batch · Wheels · 2026-10-16 · 9 CVEs total

CVE-2026-111444 9.8 CRITICAL Wheels 4.1.2 存在 SQL 注入漏洞
CVE-2026-111446 8.6 HIGH Wheels 4.0.0-4.1.2 未授权访问漏洞
CVE-2026-111445 8.1 HIGH Wheels 4.0.0-4.1.2 存在越权漏洞
CVE-2026-111447 8.1 HIGH Wheels 4.1.2 嵌套表单任意更新删除漏洞
CVE-2026-111443 6.5 MEDIUM Wheels 4.0.6-4.1.2 上下文切换漏洞
CVE-2026-111450 5.9 MEDIUM Wheels 4.1.1 冷启动 Host 头漏洞致信息泄露
CVE-2026-111449 5.9 MEDIUM Wheels 4.1.1 之前版本存在敏感信息泄露漏洞
CVE-2026-111448 3.7 LOW Wheels 4.0.0-4.1.2 路径遍历漏洞

IV. Related Vulnerabilities

Same product: Wheels CLI
Same vendor: Wheels
Same weakness: CWE-78

V. Comments for CVE-2026-111451

No comments yet

Leave a comment