CVE-2026-111451 Details
Description
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.
A vulnerability in Wheels CLI versions 4.0.0 through 4.1.1 allows for shell injection and path traversal. The issue arises because the CLI insufficiently validates or escapes user-supplied values and package contents. During deployment, release and rollback values can be manipulated to execute shell commands on the deployment host as the SSH user, and on the CI runner during builds. Additionally, the package removal command can recursively delete unintended files, and package extraction can overwrite files from other vendors. Generator commands can traverse directories or inject executable CFML into generated code. Inputs leading to these vulnerabilities may come from CI variables, branch names, packages, or an AI agent using the CLI's MCP tools.
Users can upgrade to Wheels CLI version 4.1.2, where these vulnerabilities have been addressed. After updating, existing affected views should be edited as documented in the release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wheels-dev/wheels/security/advisories/GHSA-cghp-86c6-6fjc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wheels CLI | >= 4.0.0, <= 4.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |