How severe is sql injection via string concatenation in query apis?

Shield rates this critical (CVSS 9.8), classified as CWE-89.

Rules / Kotlin

SHIELD-KOTLIN-002

SQL injection via string concatenation in query APIs

criticalKotlinCWE-89CVSS 9.8

Building a SQL string with the + operator and passing it to rawQuery, execSQL, or executeQuery permits SQL injection.

Use PreparedStatement with bound parameters or selectionArgs rather than concatenating strings.

Vulnerable — Shield flags thisRepo.kt

fun deleteUser(db: SQLiteDatabase, id: String) {
    db.execSQL("DELETE FROM users WHERE id = " + id)
}

Fixed — scans cleanRepo.kt

fun deleteUser(db: SQLiteDatabase, id: String) {
    db.execSQL("DELETE FROM users WHERE id = ?", arrayOf(id))
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-002, the fixed one does not.