CVE-2026-111451: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Wheels Wheels CLI

Wheels CLI versions 4.0.0 through 4.1.1 suffer from improper neutralization of special elements leading to OS command injection (CWE-78). Caller-supplied values and package contents are not properly validated or escaped, enabling shell command execution on deploy hosts as the SSH user and on CI runners during builds. Package removal and destroy operations can delete unintended files, package extraction can overwrite vendor files, and generator names can write outside the project or inject executable CFML code. Inputs may come from CI variables, branch names, packages, or AI agents using MCP tools. Additionally, unencoded display properties in generated scaffold show and admin views since 4.1.0 permit stored XSS. RustCFML server commands mishandle stale process IDs, potentially terminating unrelated processes. These vulnerabilities are addressed in Wheels CLI 4.1.2, with some generated views requiring documented manual edits.

Successful exploitation can lead to remote code execution on deployment hosts and CI runners, unauthorized file deletion or overwriting, injection of executable code, stored cross-site scripting attacks, and unintended termination of unrelated processes. This can compromise confidentiality, integrity, and availability of affected systems and data.

Upgrade Wheels CLI to version 4.1.2 or later, which contains fixes for these vulnerabilities. Additionally, manually apply documented edits to existing generated views to remediate stored XSS issues. No other mitigation steps are indicated by the vendor advisory.