What happened
NVD REST verified (published 2026-10-16, CVSS 7.8, CWE-78). The advisory explicitly flags AI-agent MCP tool usage of the CLI as one of the injection input channels.
Why it matters
The advisory names AI-agent-driven CLI usage as a threat surface: when a coding agent invokes deploy/publish tooling through MCP, an injected or prompt-steered version/branch value can become shell command execution on deploy hosts and CI runners — expanding the attack reach of any prompt injection into the agent's own deployment pipeline.
Attack vector
Deploy release/version/rollback values are insufficiently validated/escaped and can execute shell commands on deploy hosts as the SSH user and on CI runners during builds; package removal/destroy paths can delete unintended files; extraction can overwrite files; generator names can write outside the project. Inputs may originate from CI variables, branch names, packages, or an AI agent using the CLI's MCP tools. Also includes stored XSS in generated scaffold views and stale PID handling.
Affected systems
Wheels CLI 4.0.0 through 4.1.1 (fixed 4.1.2)
Mitigation
Upgrade to Wheels CLI 4.1.2 and apply the documented fix to already-generated views (GitHub advisory GHSA-cghp-86c6-6fjc). Sanitize any untrusted values fed to deploy/version inputs.