{"id":"CVE-2026-111444","kind":"vulnerability","aliases":["CVE-2026-111444"],"related":[],"title":"Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES…","description":"Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.","summary":"Wheels (a Python-style ORM/framework package) allows SQL injection on MySQL/MariaDB when backslash escaping is enabled and request data reaches inline-literal query paths. An attacker who controls that input can alter the SQL query, which can expose or change database data.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cfml","coldfusion","mariadb","mysql","package","wheels"],"not_affected_if":["bound-queries-only","no-mysql-or-mariadb","postgresql","sqlite"],"how_to_check":"Check the installed Wheels version (through 4.1.2 is affected) and whether any query uses parameterize=false, IN lists, BETWEEN, function arguments or LIKE ESCAPE with request data.\nCheck whether the MySQL/MariaDB session lacks NO_BACKSLASH_ESCAPES (SELECT @@sql_mode).","fix":"Upgrade Wheels to 4.2.0.\nUntil then, avoid passing request data into parameterize=false queries and unbound inline literals, or set NO_BACKSLASH_ESCAPES on the database.","status":"open","published_at":"2026-10-16T04:18:30+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:05:14+00:00","updated_at":"2026-10-23T22:28:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:05:14Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Wheels to 4.2.0.\nUntil then, avoid passing request data into parameterize=false queries and unbound inline literals, or set NO_BACKSLASH_ESCAPES on the database.","reach":"internet","impact":"high","summary":"Wheels (a Python-style ORM/framework package) allows SQL injection on MySQL/MariaDB when backslash escaping is enabled and request data reaches inline-literal query paths. An attacker who controls that input can alter the SQL query, which can expose or change database data.","category":"package","who_cares":["wheels","mysql","mariadb","coldfusion","cfml"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker alters SQL queries, reading or modifying database contents","analyst_note":"Confirm the ecosystem and language of Wheels from the NVD entry and the 4.2.0 release notes, and confirm whether the default request path reaches unbound literals.","how_to_check":"Check the installed Wheels version (through 4.1.2 is affected) and whether any query uses parameterize=false, IN lists, BETWEEN, function arguments or LIKE ESCAPE with request data.\nCheck whether the MySQL/MariaDB session lacks NO_BACKSLASH_ESCAPES (SELECT @@sql_mode).\nunknown for the exact package manifest path.","needs_analyst":true,"not_affected_if":["bound-queries-only","postgresql","sqlite","no-mysql-or-mariadb"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00057,"input_tokens":2880,"output_tokens":564,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111444':18A,21A '-2026':17A,20A '4.1.2':3A,74C,158C '4.2.0':163C 'absent':87C 'account':138C 'affect':153C 'allow':4A,35B,75C,142C 'alter':61B,146C 'applic':90C 'argument':129C 'attack':55B 'backslash':10A,14A,41B,81C,85C,140C 'bind':123C 'bound':127C,149C,156C 'cfml':22B 'chang':69B 'coldfus':23B 'control':57B 'cve':16A,19A 'data':47B,71B,93C 'databas':70B 'develop':114C 'developer-written':113C 'doubl':134C 'enabl':12A,44B,83C 'escap':11A,15A,42B,82C,86C,132C,141C 'expos':67B 'fals':105C 'fix':161C 'function':128C 'includ':100C 'inject':6A,37B,77C 'inlin':50B,96C 'inline-liter':49B,95C 'input':59B 'like':131C 'list':109C 'liter':51B,97C,133C 'mariadb':24B 'mysql':25B 'mysql/mariadb':8A,39B,79C 'opt':102C 'opt-in':101C 'orm/framework':33B 'packag':26B,34B 'parameter':104C 'parser':120C 'path':53B,98C,150C 'posit':111C 'python':31B 'python-styl':30B 'queri':52B,64B,106C,148C 'quot':136C 'reach':48B 'request':46B,92C 'singl':135C 'sql':5A,36B,63B,76C 'string':117C 'style':32B 'suppli':91C 'valu':144C 'wheel':1A,27B,28B,72C 'wherebetween':154C 'without':137C 'written':115C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111444","severity":null,"published_at":"2026-10-16T04:18:30+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}