The vulnerability stemmed from JSONP support that allowed untrusted 'jsonp' callback parameters to be reflected in responses without proper sanitization. The commit 89155f2 explicitly removed JSONP support by deleting all references to 'jsonpCallback' parameters and related response-wrapping logic in these methods. The functions were vulnerable because they directly incorporated user-controlled input into JavaScript contexts without encoding, enabling cross-site scripting attacks via malicious callback names.