The vulnerability stems from missing Computer.BUILD permission checks in the CLI command handler. The dist-fork command execution entry point (DistForkCommand.execute) would appear in runtime profiles during exploitation as it's the method that processes and executes arbitrary commands. The security advisory explicitly states the missing permission check was addressed in 1.6.0 by adding Computer.BUILD verification, confirming this as the vulnerable entry point.