{"id":"CVE-2026-110909","revision":"e5afec75bcd3410986e747cb5f4986a1","records":[{"revision":"e5afec75bcd3410986e747cb5f4986a1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110909","aliases":[],"title":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code subm…","description":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.","state":0,"publishedAt":"2026-10-15T02:56:38.852+00:00","modifiedAt":"2026-10-20T02:36:26.506+00:00","affected":[{"ecosystem":"Vendor product","name":"Wheels CLI","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Wheels CLI\",\n                    \"repo\": \"https://github.com/wheels-dev/wheels\",\n                    \"vendor\": \"Wheels\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"4.1.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":5,"severity":"MEDIUM"}],"references":["https://github.com/wheels-dev/wheels/security/advisories/GHSA-x3cm-2j3q-jgg4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110909","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110909","identifiers":["CVE-2026-110909"]},"retained":false,"historicalAffected":[]}],"coverage":[]}