The vulnerability stems from Ansible's safe_eval function in versions <1.5.4. The pre-patch code (CVE-2014-4657) used insecure regex checks (e.g., checking for 'import' or 'method()' patterns) instead of proper AST validation. The commit 998793f replaced this with an AST-based approach, adding a whitelist of allowed nodes (SAFE_NODES) and blocking dangerous functions (INVALID_CALLS). The original function's lack of these safeguards allowed attackers to craft expressions that bypassed regex checks and execute arbitrary code via unsafe Python constructs.