The vulnerability stems from the escape_command function's regex pattern. The original regex /(\\\$|)/only matched literal$(backslash + dollar) or backticks, but failed to handle standalone$, |, or other shell metacharacters. The corrected regex /[\$|]/ uses a character class to sanitize individual dangerous characters. The function's improper filtering allowed command injection via the ns_id parameter, as confirmed by the CVE description, commit diff, and exploit examples (e.g., %26 touch /tmp/das %26 bypassing sanitization).