CVE-2026-110909: Medium severity Wheels Wheels CLI vulnerability
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wheels CLIto a version that resolves this vulnerability.Fixed in 4.1.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers using Wheels CLI through 4.1.0 are exposed when they run affected CLI commands against local development-server ports. Exploitation also requires another process to be listening on a port targeted by the CLI.
What could a malicious local process obtain or do?
A process impersonating the project server can receive the project's reload password and code sent by wheels reload or wheels console. Other commands may perform unintended state-changing operations against a different local application's server and database.
Are all CLI commands affected in the same way?
wheels reload and wheels console can submit the reload password and code to the process answering the targeted HTTP request. wheels console also probes common ports when the project server is unavailable, while other commands can trigger unintended state changes on another local application.
What version resolves the issue?
The issue is fixed in Wheels CLI 4.1.1. The fix includes changes to both the CLI and the application template.