The Wheels CLI, before 4.1.1, fails to validate that the local server responding to its HTTP requests belongs to the current project. A malicious process listening on the target port can capture the project's reload password and any supplied code via wheels reload or wheels console, and can also send unintended state-changing commands to another local application's server and database. This flaw permits code execution and data modification on a different local service when the affected developer runs the CLI commands.

The vulnerability affects Wheels CLI versions 4.1.0 and earlier, distributed by Wheels. The fix is included in 4.1.1 and later releases.

The CVSS score of 5 indicates moderate severity. EPSS is not available, so the likelihood of exploitation cannot be precisely quantified, and the CVE is not listed in CISA's KEV. This vulnerability can be exploited only when a developer runs an affected command while a malicious local process listens on the expected port. In typical development environments where no other process binds to the targeted port, the risk remains limited, though an untrusted process could compromise the project via the described channel.