The vulnerability arises from the use of Django's unordered_list filter in Horizon's table columns without enabling autoescape. The affected columns (HostAggregatesTable.hosts, HostAggregatesTable.metadata, AvailabilityZonesTable.hosts) rendered user-controlled input (e.g., host aggregate names) without proper escaping. The fix involved wrapping the filter with autoescape=True, confirming that the lack of escaping in the original code was the root cause. The commit diffs explicitly modify these columns to use a safe wrapper, directly linking these functions to the XSS vulnerability.