The vulnerability stems from the dependency chain traversal logic in getAncestry. The commit 54331ec fixed this by adding a visited-map (deps) to detect cycles. The CVE description explicitly mentions infinite loops in dependency chains, and the patch diff shows cycle detection was added to this specific function. The function's purpose of recursively following parent IDs matches the vulnerability pattern described in CWE-835.