Wheels EUVD-2026-102606

Requires a MySQL or MariaDB backend with backslash escaping enabled (NO_BACKSLASH_ESCAPES mode absent - the MySQL default), AND the application must pass attacker-controlled request data into inline-literal query paths: opt-in parameterize=false queries, IN lists, or developer-written where strings at parser-unbound positions (BETWEEN bounds, function arguments, LIKE ESCAPE literals). Limiting factors that prevent exploitation: use of bound/parameterized queries (which are unaffected), whereBetween() which is bound from 4.1.2, databases other than MySQL/MariaDB, and servers running with NO_BACKSLASH_ESCAPES enabled. The authentication requirement is unauthenticated per PR:N, but the vulnerable code path depends on developer query construction rather than a simple default-config remote hit.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) describes an unauthenticated, network-reachable SQL injection (CWE-89) with full confidentiality, integrity and availability impact, which on its face is a top-priority issue. However, the description reveals material preconditions the raw score does not capture: exploitation requires (a) a MySQL/MariaDB backend with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent - the MySQL default), and (b) the application to route attacker-controlled request data into inline-literal paths such as parameterize=false queries, IN lists, or developer-written where strings at parser-unbound positions (BETWEEN bounds, function arguments, LIKE ESCAPE literals). Fully parameterized/bound paths are not affected. This makes the real-world risk highly dependent on application coding patterns rather than being universally exploitable against a default install, so the 9.8 overstates risk for deployments that rely on bound queries. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or automatable mass-exploitation; absence of these signals is not proof of safety but does argue against treating this as an under-active-attack emergency. Net: a genuine Critical-class SQLi worth prompt patching for exposed Wheels apps on MySQL/MariaDB, but the practical attack surface is gated by developer query construction, so prioritize applications known to use parameterize=false or raw where-string literals.

An attacker submits crafted request data (e.g., a query-string or form parameter) to a Wheels endpoint whose underlying query places that value into an inline SQL literal - for example a parameterize=false query or a where string using a BETWEEN bound or LIKE ESCAPE literal. Because the framework doubles single quotes but does not account for backslash escaping on MySQL/MariaDB, the attacker uses a backslash to neutralize the escaping and break out of the literal, altering the query to read, modify, or destroy database contents. No public exploit code was identified in the provided data.