CVE-2026-111444
Received Received - Intake

Wheels SQL Injection via Backslash Escaping in MySQL/MariaDB

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111444
EUVD
EUVD-2026-102606

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111444 is a critical SQL injection vulnerability in the Wheels framework versions 4.1.2 and earlier. It occurs when inline literals in MySQL/MariaDB are improperly escaped, allowing attackers to manipulate SQL queries by injecting backslashes. This affects paths where values are written as quoted literals without proper parameterization, such as when parameterize=false is enabled or in developer-written where strings like BETWEEN bounds or LIKE ESCAPE literals.

Detection Guidance

To detect this vulnerability, check if your Wheels framework version is 4.1.2 or earlier. Inspect application code for inline-literal paths with untrusted data, especially where parameterize=false is used or in developer-written where strings like BETWEEN bounds, function arguments, or LIKE ESCAPE literals.

Impact Analysis

This vulnerability can allow attackers to alter SQL queries, potentially leading to unauthorized data access, modification, or deletion. Since the severity is rated 9.8 (Critical), it poses significant risks to confidentiality, integrity, and availability of data processed by affected applications.

Mitigation Strategies

Upgrade Wheels to version 4.2.0 or later. Avoid using parameterize=false with untrusted data. Use bound APIs instead of inline literals. For MySQL/MariaDB, set sql_mode to include NO_BACKSLASH_ESCAPES.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111444. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart