{"id":"CVE-2026-111444","published":"2026-10-16T04:18:30.353","lastModified":"2026-10-16T15:19:36.177","description":"Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-mvr9-2h5x-w6cq","tags":[]}],"exploitRefs":[{"url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-mvr9-2h5x-w6cq","tags":[]}],"hasPoc":true,"ai":{"summary":"A SQL injection vulnerability exists in Wheels framework versions through 4.1.2 when using MySQL/MariaDB with backslash escaping enabled. Attackers can manipulate query structure by doubling single quotes without accounting for backslash escapes, allowing full database compromise.","exploitability":"Exploitation is straightforward with minimal preconditions - an application must use inline-literal SQL queries with parameterize=false or IN lists while running on MySQL/MariaDB with NO_BACKSLASH_ESCAPES enabled.","blast_radius":"The impact could be severe across all applications using vulnerable Wheels versions with MySQL/MariaDB backends, potentially exposing sensitive user data, session information, and application configuration.","remediation":"Upgrade to 4.2.0 immediately to address this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","database","web","framework"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:44.318Z"}}