Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as… (CVE-2026-110911)

Wheels versions 1.1.8 through 4.1.1 are vulnerable to SQL injection due to improper parsing of caller-supplied quoted values by dynamic finders (e.g., findOneByEmail), query builder methods (where with various signatures), string/UUID-key lookup functions (findByKey, updateByKey, deleteByKey, findOrCreateBy), and validatesUniquenessOf. The parser incorrectly treats doubled single quotes as the end of a literal, enabling injection. Numeric columns are unaffected. Additionally, versions 4.0.0 through 4.1.1 have a related concern in the whereBetween() method on MySQL/MariaDB with backslash escaping enabled, where string/date bounds can alter SQL. These issues are resolved in version 4.1.2.

Successful exploitation can lead to unauthorized access to sensitive data including authentication credentials, password reset tokens, and other protected information. The vulnerability allows attackers to manipulate SQL queries, potentially compromising confidentiality, integrity, and availability of the affected application data. Numeric columns are not vulnerable to this injection. No known exploits in the wild have been reported.

Upgrade affected Wheels installations to version 4.1.2 or later, where these SQL injection vulnerabilities have been fixed. No other mitigations are indicated or required according to the available data.