{"id":40288,"date":"2026-10-16T12:34:10","date_gmt":"2026-10-16T04:34:10","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111451"},"modified":"2026-10-16T12:34:10","modified_gmt":"2026-10-16T04:34:10","slug":"cve-2026-111451","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111451","title":{"rendered":"CVE-2026-111451 [HIGH] &#8211; Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values"},"content":{"rendered":"<p>Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release\/version\/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI&#8217;s MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release\/version\/rollback values can execute shell commands on deploy hosts as the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40288","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}