The vulnerability stems from the Groovy sandbox's failure to restrict finalize() method overrides. Both SandboxTransformer (from script-security plugin) and SandboxCpsTransformer (from workflow-cps plugin) didn't properly validate() these methods during AST transformation. Attackers could define classes with finalize() methods that would execute outside sandbox constraints. The patches (e.g., adding forbidIfFinalizer checks in visitMethod) and test cases in commits 16c862a/0eb89aa/e1c56eb confirm these were the vulnerable points. The transformers' method processing logic was missing finalizer validation, making these functions the root cause.