The vulnerability stems from the pre-patch implementation of MiniMagick::Image.open in lib/mini_magick/image.rb, which used Kernel#open to handle input. Kernel#open has dangerous behavior where strings starting with | execute shell commands. The patch replaced Kernel#open with URI.open for HTTP/FTP and File.open for local files, which neutralizes this vector. The added test case "| touch file.txt" in the spec file demonstrates the exploit attempt, which would have succeeded with the vulnerable Kernel#open implementation.