---
id: "CVE-2026-111444"
kind: "vulnerability"
aliases: ["CVE-2026-111444"]
title: "Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cfml", "coldfusion", "mariadb", "mysql", "package", "wheels"]
not_affected_if: ["bound-queries-only", "no-mysql-or-mariadb", "postgresql", "sqlite"]
published_at: "2026-10-16T04:18:30+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-23T22:28:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111444", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES…

Wheels (a Python-style ORM/framework package) allows SQL injection on MySQL/MariaDB when backslash escaping is enabled and request data reaches inline-literal query paths. An attacker who controls that input can alter the SQL query, which can expose or change database data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Wheels version (through 4.1.2 is affected) and whether any query uses parameterize=false, IN lists, BETWEEN, function arguments or LIKE ESCAPE with request data.
Check whether the MySQL/MariaDB session lacks NO_BACKSLASH_ESCAPES (SELECT @@sql_mode).

## Fix

Upgrade Wheels to 4.2.0.
Until then, avoid passing request data into parameterize=false queries and unbound inline literals, or set NO_BACKSLASH_ESCAPES on the database.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111444

## From the sources

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_