The vulnerability stems from the hhvm-attach deep link handler in main.js where hostname validation was missing. The commit diff shows the addition of a regex check ([^A-Za-z0-9-._]) to validate hostnames, which was absent in vulnerable versions. The affected code path involves retrieving the hostname via nuclideUri.getHostname() and immediately using it for remote URI construction without validation, making this handler the clear injection point.