The vulnerability stems from using child_process.exec() with unescaped user input to build a mail command string. The commit feee5ab shows the fix: replacing exec() with execFile() and argument arrays. The original exec() call in sendEmail combined user inputs into a shell command without proper sanitization, making it vulnerable to injection. CWE-74 (Injection) and the patch methodology confirm this assessment.