The Wheels CLI between versions 4.0.0 and 4.1.1 does not properly validate or escape caller‑supplied values and package contents. As a result, values used in deploy release, version, and rollback commands can be crafted to execute arbitrary shell commands on the deploy host as the SSH user and on CI runners during builds. In addition, package removal, destroy, and extraction paths may delete unintended files or overwrite vendor files, generator names can cause code writes outside the project, and unencoded display properties in scaffold and admin views enable stored cross‑site scripting. These weaknesses all map to CWE‑78, giving an attacker the ability to execute code, manipulate files, or inject malicious script. Affected systems include the Wheels CLI tool itself, specifically releases 4.0.0 through 4.1.1. Functions that are impacted are deploy release/version/rollback utilities, package removal/destroy endpoints, package extraction logic, generator name handling, and scaffold/admin view rendering. Security updates are available in 4.1.2; upgrades to that or later versions remove the vulnerability.

The Wheels CLI tool, specifically releases 4.0.0 through 4.1.1.

The CVSS score of 7.8 reflects a high severity risk. The EPSS score of 0.00141 (≈0.14 %) indicates a very low but nonzero likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The primary attack vector depends on the ability to influence caller‑supplied data or package contents; a threat actor could insert malicious shell commands into deploy release, version, or rollback values via CI variables, branch names, or malformed package content, leading to remote code execution on the deploy host or CI runner. File manipulation attacks are possible through package removal, destroy, or extraction handling, whereas stored XSS vectors arise from unencoded display properties in generated scaffold and admin views. These exploitation pathways require a combination of trusted deployment permissions and delivery of malicious input, but they remain realistic in environments that allow untrusted content or do not enforce strict input validation.