Wheels CLI CVE-2026-110909

Requires a process already listening on the specific local TCP port that the Wheels CLI targets - or, for wheels console specifically, on one of the common ports it probes when the project's own development server is down - AND the developer must actively run an affected command (wheels reload or wheels console, with other commands affected for state-changing operations). Limiting factors: exploitation is LOCAL only (the attacker needs the ability to run a listener on the developer's machine), depends on developer action (UI:R), and affects the development workflow rather than any production or network-facing surface; it does not apply to a developer who never runs the affected commands or whose machine hosts no untrusted local listeners.

This is a genuine but bounded developer-workstation risk rather than a mass-exploitation priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, base 5.0) correctly captures a LOCAL attack vector requiring user interaction, which inherently limits scale - there is no network-facing, unauthenticated exposure. No EPSS score was supplied, and the CVE is NOT on the CISA KEV list and has no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a confirmation-channel weakness (CWE-923) where the CLI trusts whatever process answers on a targeted local port, so the realistic threat model is a co-resident malicious or unrelated local process intercepting the project's reload password and submitted code, or triggering state-changing operations against the wrong local app's server/database. One notable tension: the official vector rates I:N, yet the description explicitly says the flaw lets commands 'perform unintended state-changing operations against a different local application's server and database,' which implies at least some integrity impact - this should be verified with the vendor advisory. Because the affected product (Wheels CLI, a CFML/ColdFusion-ecosystem developer tool) has a small footprint and exploitation requires both a pre-positioned local listener and a developer running a specific command, this is a patch-on-normal-cadence item, not an emergency.

A developer has a malicious or merely unrelated process listening on the TCP port the Wheels CLI targets (or on a common port that wheels console probes when the real project server is down). When the developer runs wheels reload or wheels console, the CLI hands the project's reload password and submitted code to that rogue listener instead of the intended project server, disclosing secrets and allowing operations against the wrong local application. No public exploit code is referenced, so this would require a custom local listener.