The vulnerability stems from how simple_format handled the html_options parameter when generating HTML tags. The pre-patch code passed options[:sanitize] as the escape flag for content, conflating content sanitization with attribute escaping. This allowed unescaped, user-controlled attributes (e.g., event handlers) to be rendered directly into the HTML output. The fix removed this flawed logic and ensured attributes are properly escaped by default via Rails' content_tag handling, as shown in the commit diff modifying the content_tag invocation.