Key points
- CVE-2026-110911 affects Wheels 1.1.8 through 4.1.1 with a CVSS score of 9.8.
- The vulnerability stems from incorrect parsing of doubled single quotes in query builders.
- Developers can patch the issue by upgrading to version 4.1.2 or later.
Security researchers have identified a critical SQL injection vulnerability in the Wheels framework, impacting versions 1.1.8 through 4.1.1. This flaw, tracked as CVE-2026-110911, carries a CVSS score of 9.8, indicating severe risk to affected systems. Applications using these versions to process user input are immediately exposed to potential data breaches if they rely on specific dynamic finder methods.
The issue arises when the framework incorrectly parses doubled single quotes as the end of a literal string. This parsing error allows attackers to inject malicious SQL code through dynamic finders like findOneByEmail, as well as the query builder’s where methods. Consequently, applications passing request data to these APIs risk exposing authentication tokens, password-reset mechanisms, and other sensitive data to unauthorized users.
Technical Context
The vulnerability specifically targets string-based lookup paths and validation methods. Functions such as findByKey, updateByKey, deleteByKey, and findOrCreateBy are vulnerable because they re-parse caller-supplied quoted values as SQL. The parser fails to handle escaped quotes correctly, breaking the intended query structure. Numeric column values remain unaffected by this specific parsing error, limiting the scope to string and UUID-key operations.
Affected Environments
Any application running Wheels versions earlier than 4.1.2 is potentially vulnerable. The risk is highest for web applications that directly pass user input to the affected dynamic finder methods or validation routines. According to the National Vulnerability Database, the flaw also extends to the query-builder whereBetween() method in versions 4.0.0 through 4.1.1 when using MySQL or MariaDB with backslash escaping enabled.
Next steps
Developers should immediately verify their current Wheels framework version. If the version is below 4.1.2, they must update to 4.1.2 or later to apply the vendor’s fix. Teams should audit their codebase for usage of the affected dynamic finders and whereBetween methods to assess exposure. Monitoring application logs for unusual query patterns is recommended while updates are deployed across all environments.
Signals worth monitoring
Teams usually detect this activity by reviewing database logs for malformed SQL syntax or unexpected query termination. Look for alerts triggered by web application firewalls regarding SQL injection attempts on endpoints that handle user input. Check for abnormal spikes in database load or errors related to syntax violations. Containment moves typically involve blocking suspicious source IPs and disabling affected endpoints until patches are applied.
What to do and how to stay safe: Wheels
- Audit all applications using Wheels to confirm they are running version 4.1.2 or higher.
- Review server logs for evidence of SQL injection attempts targeting dynamic finder methods.
- Restrict access to vulnerable endpoints if an immediate update is not feasible.
- Ensure input validation is robust for all user-supplied data passed to query builders.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wheels versions are affected by CVE-2026-110911?
Versions 1.1.8 through 4.1.1 are affected by this critical SQL injection vulnerability.
Is there a fix available for this vulnerability?
Yes, the vendor has released version 4.1.2, which resolves the parsing issue.
Does this vulnerability affect numeric column values?
No, the source material states that numeric-column values are not affected by this flaw.
