The vulnerability stemmed from how interpolation replacements were handled. The original applyReplacement function iterated over each key in the replacement hash, recursively processing nested keys. This allowed attacker-controlled values (like 'lastNameHTML') to act as new interpolation keys, enabling script injection. The patch replaced this with a single-pass regex to prevent recursive resolution. The function signature is directly visible in the pre-patch code's f.each loop and recursive applyReplacement calls.