Threat database

Wheels CLI versions 4.0.0 through 4.1.1 contain multiple security issues including OS command injection due to insufficient validation or escaping of user-supplied inputs. This allows execution of shell commands on deploy hosts and CI runners. Additional flaws include unintended file deletion, overwriting vendor files, stored XSS in generated views, and improper process termination. These vulnerabilities are fixed in version 4.1.2, but some generated views require manual edits to fully mitigate stored XSS.

Wheels CLI versions prior to 4.1.1 do not verify that the local development server responding to its HTTP requests belongs to the current project. This allows a malicious local process listening on a targeted port to receive sensitive information such as the project's reload password and code submitted via wheels reload or wheels console commands. Other commands may unintentionally affect different local applications by performing state-changing operations against their servers and databases. The vulnerability requires the developer to run an affected command while a malicious process listens on the targeted local port. This issue is fixed in version 4.1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWheels BlockWheels blockwheels allows DOM-Based XSS.This issue affects BlockWheels: from n/a through <= 1.0.2.