The vulnerability stems from insecure YAML deserialization. While exact code isn't provided, the advisory explicitly states the parser wasn't configured to prevent arbitrary type instantiation. This strongly suggests usage of an unsafe YAML loading method like SnakeYAML's Yaml.load() without a SafeConstructor. The fix in v1.41 would involve implementing type filtering, which aligns with common YAML deserialization vulnerability patterns (CWE-502). The high confidence comes from the direct match between described vulnerability behavior and known unsafe YAML parsing practices.