Quick answers
- Is CVE-2026-110911 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110911 being exploited in the wild.
- How severe is CVE-2026-110911?
- Critical severity, with a CVSS score of 9.8, published 15 October 2026.
- Which products and versions are affected?
- Wheels 1.1.8 through 4.1.1.
- Is there a fix for CVE-2026-110911?
- Yes: fixed in 4.1.2. Until then: Validate and whitelist request values before passing them to the affected APIs, or perform record lookups by numeric primary key only. Where possible, use the query builder's where() method with explicit parameter binding.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-01"}, {"kind": "patched", "at": "2026-10-15", "note": "fix released in version 4.1.2"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110911 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-110911?
- Check whether you run Wheels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.1.2
Validate and whitelist request values before passing them to the affected APIs, or perform record lookups by numeric primary key only. Where possible, use the query builder's where() method with explicit parameter binding.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-01"}, {"kind": "patched", "at": "2026-10-15", "note": "fix released in version 4.1.2"}]
Technical details
SQL injection occurs because several APIs (dynamic finders like findOneByEmail, query builder methods where() and whereBetween(), and validatesUniquenessOf) quote user-supplied values and re-parse them as SQL, but treat doubled single quotes ('' → '') as literal characters rather than escape sequences. An attacker can inject SQL logic (e.g., "nomatch' OR email<>'") to alter query semantics. On MySQL/MariaDB with backslash escaping, whereBetween() with string or date bounds is also vulnerable. The fix in 4.1.2 uses parameterized queries instead of string concatenation and re-parsing.
Affected products
- Wheels Wheels 1.1.8 through 4.1.1