CVE-2026-111444: Wheels SQL injection on MySQL/MariaDB with backslash escaping

CVE-2026-111444 · Severity: critical · CVSS 9.8 · Published 2026-10-16

Wheels is a web application framework that uses a query builder to generate SQL commands. In versions up to 4.1.2, applications using MySQL or MariaDB can be vulnerable to SQL injection if they pass user-controlled data to certain query methods or to inline WHERE clauses, because the framework only escapes single quotes without accounting for backslash escape sequences. An attacker could inject malicious SQL to read, modify, or delete database records.

Technologies: Wheels. Vendors: Wheels.

Quick answers

Is CVE-2026-111444 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111444 being exploited in the wild.
How severe is CVE-2026-111444?
Critical severity, with a CVSS score of 9.8, published 16 October 2026.
Which products and versions are affected?
Wheels through 4.1.2.
Is there a fix for CVE-2026-111444?
Yes: fixed in 4.2.0. Until then: Pass request data only through bound APIs (where property/value methods, dynamic finders, whereIn, whereBetween), avoid using parameterize=false with user input, or set NO_BACKSLASH_ESCAPES in the MySQL/MariaDB sql_mode. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111444 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-111444?
Check whether you run Wheels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.2.0

Pass request data only through bound APIs (where property/value methods, dynamic finders, whereIn, whereBetween), avoid using parameterize=false with user input, or set NO_BACKSLASH_ESCAPES in the MySQL/MariaDB sql_mode.

Technical details

The vulnerability exists in Wheels' handling of inline SQL literals on MySQL and MariaDB when backslash escaping is enabled (the default sql_mode). Affected code paths include parameterize=false queries, IN-list handling, and unbound positions in WHERE strings (BETWEEN bounds, function arguments, LIKE ESCAPE). The framework escapes only single quotes by doubling them, but on MySQL/MariaDB a backslash is also an escape character, allowing an attacker to break out of a quoted string. Bound query methods and parameterized queries are not affected. The fix in version 4.2.0 converts values containing backslashes to hex literals on MySQL/MariaDB.

Affected products

  • Wheels Wheels through 4.1.2

Timeline

  • 2026-10-12: disclosed
  • 2026-10-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.