The vulnerability stems from improper sanitization in the limit() method's parameter handling. The commit diff shows explicit (int) casting was added to $statements['limit'] and $statements['offset'] in BaseAdapter.php's select method to fix SQL injection. Before patching, non-integer values (like SQL expressions) passed to limit() were directly embedded in SQL queries. The Snyk PoC demonstrates exploiting this by passing a subquery string to limit().