Critical SQL Injection Flaw Found in Wheels Framework Versions Before 4.1.2

The Wheels framework contains a critical security flaw that allows attackers to perform SQL injection attacks through dynamic finder methods. The National Vulnerability Database lists this issue as CVE-2026-110911, assigning it a maximum severity score of 9.8. This vulnerability impacts all versions of the framework from 1.1.8 up to and including 4.1.1, leaving a wide range of applications potentially exposed to unauthorized data access and manipulation if they rely on these specific query-building features.

The core technical issue involves how the framework parses caller-supplied quoted values when they are processed again as SQL by dynamic finders. According to the NVD record, the parser incorrectly treats a doubled single quote as the end of a literal string rather than an escaped character. This misinterpretation allows malicious input to break out of the intended SQL context, enabling injection. The flaw affects several common API methods, including findOneByEmail, and the query builder’s where functions that accept property, value, or operator arguments.

Scope of the Vulnerability

The vulnerability extends beyond simple lookups to include string and UUID-key lookup paths such as findByKey, updateByKey, deleteByKey, and findOrCreateBy methods. Additionally, the validatesUniquenessOf function is also susceptible to this type of injection because it relies on the same parsing logic. Applications that pass user request data directly to these APIs can expose sensitive information, including authentication credentials, password-reset tokens, and other protected data. The NVD notes that numeric-column values are not affected by this specific parsing error, limiting the attack surface to string-based inputs.

A related concern exists for the whereBetween() method in versions 4.0.0 through 4.1.1. In environments using MySQL or MariaDB with backslash escaping enabled, string and date bounds passed to this method can alter the underlying SQL query. This secondary issue further complicates the security posture of applications using these specific database configurations and framework versions. The combination of these flaws means that developers must carefully audit any usage of dynamic finders and query builders in affected versions.

Who Is Affected

Any application running Wheels framework version 1.1.8 through 4.1.1 is potentially affected by CVE-2026-110911. The risk is highest for applications that accept user input and pass it directly to dynamic finder methods or the query builder’s where functions. Since the flaw allows for SQL injection, attackers could potentially bypass authentication mechanisms or extract unauthorized data from the database. The NVD record explicitly states that the issue is fixed in version 4.1.2, providing a clear remediation path for affected systems.

What should you do?

Organizations using the Wheels framework should immediately verify their current version against the affected range. If an application is running version 4.1.1 or earlier, the vendor has released version 4.1.2 to address these vulnerabilities. Upgrading to this latest version is the primary recommended action to mitigate the risk of SQL injection. Until the update is applied, administrators should consider restricting input to these specific API methods or implementing additional input validation layers to prevent malicious SQL strings from being processed.