CVE-2026-111451
Received Received - Intake

Wheels CLI Command Injection and Path Traversal Vulnerabilities

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111451
EUVD
EUVD-2026-102604

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels CLI 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Wheels CLI 4.0.0 through 4.1.1 has multiple security flaws due to insufficient input validation and escaping. Untrusted inputs like branch names or CI variables can execute shell commands on deploy hosts or CI runners via the wheels deploy command. Path traversal allows file deletion or overwriting outside intended directories. Code injection can occur in generated CFML files, and stored XSS exists in scaffolded views due to unencoded output. Stale process IDs may also terminate unrelated processes.

Detection Guidance

Check Wheels CLI version with 'wheels version'. If between 4.0.0 and 4.1.1, the system is vulnerable. Review CI/CD pipeline logs for suspicious commands in deploy or build steps. Inspect generated CFML files for unexpected code injection or XSS payloads in scaffolded views.

Impact Analysis

An attacker could execute arbitrary commands on your deploy hosts or CI runners, delete or overwrite critical files, inject malicious code into your applications, or even terminate unrelated processes. This could lead to data breaches, system compromise, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access, data exfiltration, or system manipulation, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements for protected health information. Non-compliance risks include fines, legal action, and reputational damage.

Mitigation Strategies

Upgrade Wheels CLI to version 4.1.2 or later immediately. Avoid passing untrusted input to deploy, package removal, or generator commands. Review and sanitize CI variables, branch names, and package sources. Manually edit affected generated views to encode display properties to prevent XSS.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart