# CVE-2026-110911: Wheels SQL injection in dynamic finders and key lookups

Source: https://junglewise.ai/threats/cve-2026-110911-wheels-1-1-8-through-4-1-1-allows-sql-injection-when-caller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110911 · Severity: critical · CVSS 9.8 · Published 2026-10-15

Wheels, a web application framework, contains SQL injection vulnerabilities in methods used to query and validate data. An attacker can bypass authentication lookups, reset-token checks, and read unauthorized data by injecting SQL fragments into quoted values. Applications that pass user input to affected APIs—including login and password-reset features—are at risk of account takeover and data exposure.

Technologies: [Wheels](https://junglewise.ai/threats/technologies/wheels). Vendors: [Wheels](https://junglewise.ai/threats/vendors/wheels).

## Quick answers

**Is CVE-2026-110911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110911 being exploited in the wild.

**How severe is CVE-2026-110911?** Critical severity, with a CVSS score of 9.8, published 15 October 2026.

**Which products and versions are affected?** Wheels 1.1.8 through 4.1.1.

**Is there a fix for CVE-2026-110911?** Yes: fixed in 4.1.2. Until then: Validate and whitelist request values before passing them to the affected APIs, or perform record lookups by numeric primary key only. Where possible, use the query builder's where() method with explicit parameter binding.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-01"}, {"kind": "patched", "at": "2026-10-15", "note": "fix released in version 4.1.2"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110911 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-110911?** Check whether you run Wheels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.1.2

Validate and whitelist request values before passing them to the affected APIs, or perform record lookups by numeric primary key only. Where possible, use the query builder's where() method with explicit parameter binding.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-01"}, {"kind": "patched", "at": "2026-10-15", "note": "fix released in version 4.1.2"}]

## Technical details

SQL injection occurs because several APIs (dynamic finders like findOneByEmail, query builder methods where() and whereBetween(), and validatesUniquenessOf) quote user-supplied values and re-parse them as SQL, but treat doubled single quotes ('' → '') as literal characters rather than escape sequences. An attacker can inject SQL logic (e.g., "nomatch' OR email<>'") to alter query semantics. On MySQL/MariaDB with backslash escaping, whereBetween() with string or date bounds is also vulnerable. The fix in 4.1.2 uses parameterized queries instead of string concatenation and re-parsing.

## Affected products

- Wheels Wheels 1.1.8 through 4.1.1

## References

- [https://github.com/wheels-dev/wheels/security/advisories/GHSA-96rm-h22v-925x](https://github.com/wheels-dev/wheels/security/advisories/GHSA-96rm-h22v-925x)

## Related threats

- [Wheels Host header injection in production error email derivation](https://junglewise.ai/threats/cve-2026-111450-wheels-through-4-1-1-derives-its-default-production-error-email)
- [Wheels framework authorization bypass in nested properties](https://junglewise.ai/threats/cve-2026-111447-wheels-1-1-through-4-1-2-resolves-nestedproperties-records-by)
- [Wheels authorization bypass in findByKey() and exists()](https://junglewise.ai/threats/cve-2026-111445-wheels-4-0-0-through-4-1-2-before-4-2-0-replaces-incoming-scope)
- [Wheels SQL injection on MySQL/MariaDB with backslash escaping](https://junglewise.ai/threats/cve-2026-111444-wheels-through-4-1-2-allows-sql-injection-on-mysql-mariadb-with)
- [Wheels test context access control bypass](https://junglewise.ai/threats/cve-2026-111443-wheels-4-0-6-through-4-1-2-lets-an-unauthenticated-client-switch)