Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended stat
Exploit
CVE-2026-110909
NVD
Refer to CVE-2026-110909 NVD advisory