Wheels framework: SQL injection via inline literals on MySQL and MariaDB

Summary

Wheels up to version 4.1.2 allows SQL injection on MySQL and MariaDB when backslash escaping is active. Some code paths write request data into SQL as quoted literals and only double single quotes, which does not stop a backslash from breaking out of the string. An unauthenticated remote attacker could read, change or delete database content if an application passes request data into affected paths such as parameterize=false queries, IN lists or unbound where-string positions.

Affected

• Wheels up to and including 4.1.2 (CNA record: versions before 4.2.0)
• Only applications on MySQL or MariaDB with the default sql_mode (no NO_BACKSLASH_ESCAPES)
• Only where request data reaches parameterize=false queries, IN lists, or unbound BETWEEN, function argument or LIKE ESCAPE literals in where strings
• PostgreSQL, SQL Server, SQLite, Oracle, H2 and CockroachDB are not affected according to the vendor

Fixed in

• Wheels 4.2.0

Workaround

• Pass request data only through bound APIs such as where(property, value), dynamic finders, whereIn and whereBetween (4.1.2 and later)
• Do not use parameterize=false with request data
• Set NO_BACKSLASH_ESCAPES in the MySQL or MariaDB sql_mode (test first, as it can affect other applications; this is not vendor-confirmed)

Exploitation

• Public proof of concept repository exists under the CVE name; content not reviewed
• No evidence of exploitation in the wild or listing in CISA KEV found
• CISA SSVC: exploitation none, automatable no, technical impact total

Our recommendation

• Identify all Wheels applications and their versions
• Upgrade to Wheels 4.2.0; installations on 4.1.x must not stop at 4.1.2
• Review use of parameterize=false and raw where strings that take user input
• Treat internet-facing Wheels applications on MySQL or MariaDB as critical priority
• Monitor database logs for unusual query errors or syntax anomalies

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Syscallh00k/CVE-2026-111444

Research sources

• GitHub Security Advisory GHSA-mvr9-2h5x-w6cq github.com
• OSV: CVE-2026-111444 osv.dev
• Wheels release v4.2.0 github.com
• Vulners: CVE-2026-111444 (CNA data) vulners.com
• VulDB: CVE-2026-111444 vuldb.com
• OSV: CVE-2026-110911 (related fix in 4.1.2) osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:45.