Wheels CLI CVE-2026-111451

Exploitation requires that the Wheels CLI (version 4.0.0 through 4.1.1) be executed against attacker-influenced input. The specific triggers named in the advisory are: deploy release/version/rollback values (shell command execution on deploy hosts as the SSH user and on the CI runner during builds); package removal/destroy and extraction paths (arbitrary file deletion or overwrite of vendor files); and generator names (writing outside the project or injecting executable CFML). These inputs must originate from a semi-trusted or untrusted source - CI variables, Git branch names, downloaded packages, or an AI agent invoking the CLI's MCP tools. The stored XSS condition specifically requires use of the scaffold 'show' views generated on or after 4.1.0, or generated admin views, with unencoded display properties. Limiting factors: the vector is local (AV:L) and requires user or pipeline interaction (UI:R) - a human or automated process must actually run the vulnerable CLI command; it is not remotely exploitable over a network against a running service. Environments where all CLI inputs (branch names, packages, CI variables) are fully controlled by trusted operators are not realistically exposed. Remediation requires upgrading to 4.1.2 AND applying the documented manual edit to any already-generated affected views.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly reflects a locally-triggered command-injection flaw (CWE-78) that yields full confidentiality, integrity and availability impact - code execution as the SSH deploy user or on the CI runner. The defining signal is the attack vector: although PR:N implies no authentication, the vulnerability is not a remote-unauthenticated internet-facing bug; it is AV:L with UI:R, meaning a developer, operator, or CI pipeline must run the Wheels CLI against attacker-influenced inputs (CI variables, branch names, package contents, or MCP tool calls from an AI agent). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore moderate and conditional rather than wormable: real priority for teams running Wheels CLI 4.0.0-4.1.1 in automated CI/CD or MCP-agent contexts where branch names or packages are not fully trusted, but lower urgency for environments where all CLI inputs are controlled by trusted operators. Note a tension worth verifying: PR:N combined with UI:R and AV:L describes a supply-chain/input-trust boundary (e.g., a malicious branch name or package reaching an automated runner) rather than classic credentialed access - defenders should map which of their pipelines feed untrusted data into these commands.

An attacker who can influence a CI variable, a Git branch name, a package pulled during build, or input to the CLI's MCP tools supplies a crafted deploy release/version/rollback value containing shell metacharacters; when the Wheels CLI runs during an automated build or deploy, the value is executed as a shell command on the CI runner or on the deploy host as the SSH user. Alternatively, a malicious package triggers path traversal during removal/extraction to overwrite or delete vendor files, or a crafted generator name writes executable CFML outside the project. No public proof-of-concept was provided, and exploitation requires the victim pipeline or developer to run the CLI (UI:R) against the attacker-influenced input (AV:L/AC:L).