{"id":"CVE-2026-110909","aliases":["EUVD-2026-101817","GHSA-8qgh-9996-h3c4","GHSA-x3cm-2j3q-jgg4"],"status":"published","title":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP...","description":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00134,"percentile":0.0298,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-923"],"published":"2026-10-15T02:56:38Z","modified":"2026-10-28T02:30:54Z","products":[{"vendor":"wheels","product":"wheels cli"}],"references":[{"url":"https://github.com/wheels-dev/wheels/security/advisories/GHSA-x3cm-2j3q-jgg4","tags":["vendor-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110909","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8qgh-9996-h3c4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110909.json","tags":["advisory"]},{"url":"https://github.com/wheels-dev/wheels","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-110909","description":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.","status":"published","published":"2026-10-15T02:56:38.852Z","modified":"2026-10-20T02:36:26.506Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-923"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-101817","description":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.","status":"published","published":"2026-10-15T02:56:38Z","modified":"2026-10-20T02:36:26Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:44.419021Z"}],"ghsa":[{"id":"GHSA-8qgh-9996-h3c4","title":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP...","description":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.","status":"published","published":"2026-10-15T03:36:27Z","modified":"2026-10-15T03:36:28Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-923"],"updated_at":"2026-11-02T15:13:34.67317Z"}],"nvd":[{"id":"CVE-2026-110909","description":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.","status":"published","published":"2026-10-15T03:17:10.947Z","modified":"2026-10-20T03:17:14.683Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-923"],"updated_at":"2026-11-02T14:12:59.328869Z"}],"osv":[{"id":"CVE-2026-110909","description":"Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.","status":"published","published":"2026-10-15T02:56:38.852Z","modified":"2026-10-28T02:30:54.626283961Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-923"],"updated_at":"2026-11-02T15:44:55.61515Z"}]}}