Wheels Wheels CLI

• CVE-2026-111451 High 7.8 Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the 0.1%
• CVE-2026-110909 Medium 5.0 Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the 0.1%