Wheels up to and including version 4.1.2 contains a flaw that permits SQL injection when the application supplies request data that is incorporated directly into inline‑literal SQL paths. The problem occurs in environments where the MySQL or MariaDB server has backslash escaping enabled because the NO_BACKSLASH_ESCAPES mode is missing. This is a CWE‑89 SQL injection flaw, where an attacker can inject arbitrary SQL by inserting doubled single quotes, which the parser interprets as part of the query. The consequence is the potential for an attacker to read, modify, or delete database data, potentially resulting in full database compromise.

All installations of Wheels 4.1.2 or earlier are affected. The flaw is triggered by inline‑literal queries such as parameter‑less queries with option parameterize=false, IN lists, and developer‑written WHERE clauses that are not bound. The vulnerability is fixed in Wheels 4.2.0.

The CVSS base score of 9.8 indicates critical severity. The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to supply arbitrary input to database query paths, which typically requires remote network or application access. Once exploited, the attacker can execute arbitrary SQL against the MySQL or MariaDB database, potentially gaining unlimited data access and manipulation capabilities. The likely attack vector is remote via web or API endpoints that accept user input, based on the description and typical deployment scenarios.