The advisory explicitly names these methods as vulnerable vectors. They handle user input that gets embedded into Redis LUA scripts without proper validation(). Since Redis executes LUA scripts in a sandbox with limited capabilities, improper input sanitization in these ActiveRecord methods could allow attackers to break out of intended query logic and execute arbitrary operations. The CWE-94 classification confirms this is a code injection scenario where attacker-controlled data influences script execution.