Wheels 1.1.8 through 4.1.1 are vulnerable to SQL injection because caller-provided quoted values are parsed again as SQL by dynamic finders, the query builder's where clauses, string/UUID-key lookup paths, and validateUniquenessOf. The parser mistakenly treats a doubled single quote as the end of a literal, allowing injection when a request contains a single quote. As a result, attackers can corrupt authentication, password‑reset, or token lookups and gain access to sensitive data. Numeric-column values are not affected. A related issue exists for query‑builder whereBetween in 4.0.0 through 4.1.1, where string or date bounds can alter SQL on MySQL/MariaDB when backslash escaping is enabled.

The affected product is Wheels, a library used in various web and backend applications. All released versions from 1.1.8 up to and including 4.1.1 contain the flaw. Versions prior to 1.1.8 and the first patched release 4.1.2 and later are not affected.

This flaw has a CVSS score of 9.8 and is not listed in the CISA KEV catalog. The EPSS score is not available, so the exploitation probability cannot be quantified from that metric. The vulnerability is exploitable through the exposed APIs when an attacker can supply crafted input to dynamic finder methods such as findOneByEmail or the query builder’s where function. Successful exploitation yields unauthorized read access and potentially other data manipulations, depending on application logic.