The vulnerability stems from unescaped output of user-controlled input fields in JSP rendering. While no direct code patches are shown, the exploit documentation and Apache's security advisory confirm the attack vector involves JSPs that display chat messages without proper encoding. The _jspService method in JSP-compiled servlets handles output generation, making it the runtime-visible function when malicious payloads are rendered.