The vulnerability stemmed from error responses (including user-controllable input) being served with text/html Content-Type. The critical fixes in the commit 7222bd5: (1) introduced APIHandler to enforce 'application/json' headers, and (2) modified the json_errors decorator to explicitly set this header during exception handling. Functions like write_error and API endpoint handlers (e.g., ApiVersionHandler.get) relied on these mechanisms. Prior to the patch, missing headers allowed XSS when error messages containing attacker-controlled data were reflected without proper escaping or content type restrictions.