CVE-2026-111444: SQL Injection
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NOBACKSLASHESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wheelsto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Wheels through 4.1.2 with MySQL or MariaDB are exposed only when backslash escaping is enabled, meaning NO_BACKSLASH_ESCAPES is absent, and application-controlled request data reaches an inline-literal query path.
What application code patterns make exploitation possible?
Risk exists for opt-in parameterize=false queries, IN lists, and unbound positions in developer-written where strings, including BETWEEN bounds, function arguments, and LIKE ESCAPE literals. Bound query paths are not affected.
Are applications using whereBetween() affected?
whereBetween() is bound starting in version 4.1.2, so that method is not affected in 4.1.2. Other inline-literal or unbound query constructions may still be vulnerable.
What should be done if upgrading cannot happen immediately?
Avoid passing request data into inline-literal query paths and use bound query paths instead. In particular, remove or avoid parameterize=false usage and review developer-written where strings for unbound values.
How can teams determine whether they are affected?
Check whether the application runs Wheels through 4.1.2 on MySQL or MariaDB without NO_BACKSLASH_ESCAPES, then review query code for request-controlled values used in parameterize=false queries, IN lists, or unbound where-string positions. Version 4.2.0 contains the fix.