The vulnerability stems from insecure XML parsing in the MercurialChangeLogParser class. The pre-patch implementation used Digester2 (from Apache Commons Digester) to parse XML changelogs without disabling external entity resolution. The commit diff shows a replacement of Digester with secure XMLUtils.parse() which explicitly disables XXE. The parse method was the entry point for XML processing and lacked security configurations like setFeature(XMLConstants.FEATURE_SECURE_PROCESSING) or setExpandEntityReferences(false), making it vulnerable to XXE injection.