The vulnerability stems from two unescaped output locations: 1) In ui.js's grid component, the column.format-derived value was rendered without escaping (fixed by adding Thelpers.encode()). 2) In index.html's notification template, item.message was inserted raw (fixed by adding Thelpers.encode()). Both locations directly inject user-influenced content into the DOM without sanitization, matching classic XSS patterns. The commits explicitly show encoding being added to these exact locations, confirming their vulnerability.