Wheels vulnerabilities
We track 6 vulnerabilities in Wheels products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Wheels vulnerabilities
- 7.8 High severity
Wheels CLI: Improper Neutralization of Special Elements used in an OS Command
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package remova
- 8.1 High severity
Wheels: External Control of Assumed-Immutable Web Parameter
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne
- 8.6 High severity
Wheels: Incorrect Authorization
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts
- 8.1 High severity
Wheels: Incorrect Resource Transfer Between Spheres
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Appl
- 9.8 Critical severity
Wheels: Improper Neutralization of Special Elements used in an SQL Command
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positi
- 9.8 Critical severity
Wheels: Improper Neutralization of Special Elements used in an SQL Command
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup path