The vulnerability stems from the resolve() function in lib/dns-sync.js where user-controlled hostname input was directly interpolated into a shell command string (via util.format) without validation. The pre-patch code lacked hostname sanitization, enabling attackers to inject commands through shell metacharacters. The commit d9abaae specifically adds hostname validation to this function to mitigate the injection, and the CVE description explicitly mentions the resolve API as the attack vector. The shell.exec call with unsanitized input creates the command injection vulnerability through command string construction.