The vulnerability stems from markdown-pdf enabling HTML rendering in its Remarkable parser by default. The key change in the patch removes the 'html: true' default in the options object passed to Remarkable. The markdownpdf function in index.js is directly responsible for this insecure configuration. During exploitation, this function would appear in the profiler as it sets up the processing pipeline with vulnerable defaults. While the actual HTML rendering occurs in Remarkable's code, the root cause is markdownpdf's configuration, which is explicitly modified in the patch.