The advisory explicitly mentions si.inetLatency() as the entry point requiring parameter sanitization. The commit 1faadcb shows the vulnerability stemmed from inadequate filtering in sanitizeShellString (in lib/util.js), which was used to process inputs for network latency checks. The addition of single quote and backtick filtering in the sanitization function confirms command injection vectors were possible through this function's parameters prior to v4.31.1.