CVE-2026-110911: SQL Injection
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.2
Event History
Frequently Asked Questions
Which applications are most exposed?
Applications that pass request-controlled data into affected dynamic finders, key lookup methods, query-builder where methods, or validatesUniquenessOf are exposed. Authentication, password-reset, token lookup, and other string or UUID-based lookups are specifically at risk; numeric-column values are not affected.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted quoted value that the application passes to an affected API. No authentication or user interaction is required according to the listed vector.
Are all affected query paths impacted in the same way?
The doubled-single-quote parsing issue affects versions 1.1.8 through 4.1.1. The whereBetween() concern is limited to versions 4.0.0 through 4.1.1 and requires string or date bounds on MySQL or MariaDB with backslash escaping enabled.
What is the available remediation?
Upgrade to Wheels 4.1.2, which fixes the issue. If an immediate upgrade is not possible, avoid passing request data directly to the affected APIs, particularly for string and UUID values and for string or date whereBetween() bounds on affected database configurations.